Policy compliance of container images

Patent metadata

Field	Value
Publication number	US-10078577-B2
Application number	US-201615005320-A
Country	US
Kind code	B2
Filing date	Jan 25, 2016
Priority date	Jan 25, 2016
Publication date	Sep 18, 2018
Grant date	Sep 18, 2018

Abstract

In some examples, a container image is received, where a container is to be launched from the container image. An executable process is deployable in the container to isolate the executable process from another executable process. The container image is annotated with metadata specifying a policy. Compliance of the container image with the policy is checked in a test environment prior to publication of the container image to a registry for use in a production environment.

First claim

What is claimed is:

1. A method comprising:
receiving, by a system comprising a processor, a container image from which a container is to be launched, an executable process being deployable in the container to isolate the executable process from another executable process, the container image annotated with metadata specifying a policy; and
checking, by the system, compliance of the container image with the policy in a test environment prior to publication of the container image to a registry for use in a production environment, wherein the checking comprises launching the container from the container image in the test environment, and checking compliance of the launched container in the test environment with the policy, wherein the test environment is separate from the production environment.

2. The method of claim 1 , further comprising:
preventing publication of the container image to the registry in response to determining that the container image is not in compliance with the policy; and
publishing the container image to the registry in response to determining that the container image is in compliance with the policy.

3. The method of claim 1 , wherein the container image includes information relating to the executable process, and information that relates to dependencies of the executable process.

4. The method of claim 1 , wherein launching the container from the container image comprises causing deployment of a logical partition in the system, the executable process and the dependencies of the executable process deployed in the logical partition.

5. The method of claim 1 , further comprising collecting a result of the checking and outputting the result for use in remediating the container image.

6. The method of claim 1 , wherein the container is a lightweight container that includes the executable process but that is without any operating system in the lightweight container.

7. The method of claim 6 , wherein the lightweight container is to share a host operating system with another lightweight container.

8. The method of claim 1 , wherein the container image is part of a group of container images, and wherein the checking is performed to determine whether the group of container images is in compliance with the policy.

9. A system comprising:
a processor;
a test environment; and
a non-transitory storage medium storing policy checking instructions executable on the processor to:
launch a container from a container image in the test environment,
determine whether the container launched in the test environment is in compliance with a policy, and
in response to determining that the container is not in compliance with the policy, prevent publication of the container image to a registry from which the container image is accessible to launch the container in a production environment different from the test environment.

10. The system of claim 9 , wherein the container image is annotated with metadata specifying the policy.

11. The system of claim 9 , wherein the policy checking instructions are executable on the processor to:
publish the container image to the registry in response to determining that the container is in compliance with the policy.

12. The system of claim 9 , wherein the container image is part of a group of container images, and wherein the policy checking instructions are executable on the processor to:
launch, in the test environment, containers from the container images in the group of container images, and
determine whether the containers launched in the test environment are in compliance with the policy.

13. The system of claim 9 , wherein the container is a lightweight container that includes an application program but that is without any operating system in the lightweight container.

14. The system of claim 9 , wherein the container is a virtual machine that includes a guest operating system.

15. The system of claim 9 , wherein the container image includes information that relates to an executable code that is to be deployed in the container when launched, and information that relates to dependencies of the executable code, and
wherein launching the container comprises launching the executable code and the dependencies in the container.

16. A non-transitory machine-readable storage medium storing instructions that upon execution cause a system to:
receive a policy to be associated with a container image from which a container is to be launched, an executable process being deployable in the container to isolate the executable process from another executable process;
annotate the container image with metadata specifying the policy; and
check compliance of the container image with the policy in a test environment prior to publication of the container image to a registry for use in a production environment, wherein the checking comprises launching the container from the container image in the test environment, and checking compliance of the launched container in the test environment with the policy, wherein the test environment is separate from the production environment.

17. The non-transitory machine-readable storage medium of claim 16 , wherein the instructions upon execution cause the system to:
prevent publication of the container image to the registry in response to determining that the container image is not in compliance with the policy; and
publish the container image to the registry in response to determining that the container image is in compliance with the policy.

18. The non-transitory machine-readable storage medium of claim 16 , wherein the policy is received based on user input.

19. The non-transitory machine-readable storage medium of claim 16 , wherein the annotating comprises embedding the metadata in the container image or providing information in the container image that refers to the metadata.

Assignees

• Hewlett Packard Entpr Dev Lp
• Entit Software Llc

Inventors

• Thomas Kishan
• Pan Dongye
• Wong Hong
• Tran Steven Lamdien

Classifications

• G06F11/3668 Primary

  Testing of software · CPC title

• G06F8/63

  Image based installation; Cloning; Build to order · CPC title