Managing updates to container images

Patent metadata

Field	Value
Publication number	US-10324708-B2
Application number	US-201715812026-A
Country	US
Kind code	B2
Filing date	Nov 14, 2017
Priority date	Nov 14, 2017
Publication date	Jun 18, 2019
Grant date	Jun 18, 2019

Abstract

Updates to container images can be managed. For example, a processing device can detect that a first container-image is updated by monitoring a repository associated with the first container-image. The first container-image can be updated subsequent to a second container-image being built. The processing device can determine that the second container-image depends on the first container-image by analyzing a database that indicates a dependency relationship between the second container-image and the first container-image. The processing device can then automatically rebuild the second container-image using an updated version of the first container-image in response to (i) detecting that the first container-image was updated, and (ii) determining that the second container-image depends on the first container-image.

First claim

The invention claimed is:

1. A method comprising:
receiving, by a processing device, an alert for a piece of software;
in response to receiving the alert, determining, by the processing device, that a first container-image comprises the piece of software;
in response to determining that the first container-image comprises the piece of software, monitoring, by the processing device, a repository configured to store one or more versions of the first container-image for an updated version of the first container-image;
while monitoring the repository, detecting, by the processing device, the updated version of the first container-image, wherein the first container-image is updated subsequent to a second container-image being built;
determining, by the processing device, that the second container-image depends on the first container-image by analyzing a database that indicates a dependency relationship between the second container-image and the first container-image; and
in response to (i) detecting the updated version of the first container-image and (ii) determining that the second container-image depends on the first container-image, automatically rebuilding, by the processing device, the second container-image using the updated version of the first container-image to create an updated version of the second container-image.

2. The method of claim 1 , further comprising, prior to monitoring the repository for the updated version of the first container-image:
receiving the alert for the piece of software by accessing a database of alerts;
in response to receiving the alert, determining that the alert meets one or more predefined criteria in a customizable rule set by analyzing the alert;
based on determining that the alert meets the one or more predefined criteria, determining that the piece of software is to be updated;
and
based on determining that (i) the piece of software is to be updated and (ii) the first container-image includes the piece of software, flagging the first container-image for monitoring.

3. The method of claim 2 , wherein the one or more predefined criteria comprises at least one of (i) the piece of software being a predefined piece of software; (ii) a product related to the piece of software being a predefined product; (iii) a severity level of the alert being a predefined severity-level; (iv) a date related to the alert being a predefined date; or (v) a programming language related to the piece of software being a predefined programming language.

4. The method of claim 2 , further comprising:
based on flagging the first container-image for monitoring, monitoring the repository to detect when the first container-image is updated; and
detecting that the first container-image was updated based on the updated version of the first container-image being stored in the repository.

5. The method of claim 1 , further comprising determining that the second container-image depends on the first container-image by:
analyzing a plurality of container images to determine one or more container dependencies for each respective container-image of the plurality of container images;
storing a respective relationship between each respective container-image and the one or more container dependencies in the database; and
determining that there is a correspondence between the second container-image and the first container-image in the database.

6. The method of claim 1 , further comprising:
determining that multiple container images depend on the first container-image using the database; and
rebuilding the multiple container images in response to (i) detecting that the first container-image was updated and (ii) determining that the multiple container images depend on the first container-image.

7. The method of claim 1 , further comprising:
in response to detecting that the updated version of the second container-image is created, provisioning a test environment that has one or more characteristics defined by a customizable rule-set;
running one or more tests in the test environment on the updated version of the second container-image to ensure that the updated version of the second container-image complies with one or more predefined requirements, the one or more tests being defined by the customizable rule-set;
determining that the updated version of the second container-image passed the one or more tests; and
based on determining that the updated version of the second container-image passed the one or more tests, shutting down the test environment.

8. A system comprising:
a processing device; and
a memory device that includes instructions executable by the processing device for causing the processing device to:
receive an alert for a piece of software;
in response to receiving the alert, determine that a first container-image comprises the piece of software;
in response to determining that the first container-image comprises the piece of software, monitor a repository configured to store one or more versions of the first container-image for an updated version of the first container-image;
while monitoring the repository, detect the updated version of the first container-image, wherein the first container-image is updated subsequent to a second container-image being built;
determine that the second container-image depends on the first container-image by analyzing a database that indicates a dependency relationship between the second container-image and the first container-image; and
in response to (i) detecting the updated version of the first container-image and (ii) determining that the second container-image depends on the first container-image, automatically rebuild the second container-image using the updated version of the first container-image to create an updated version of the second container-image.

9. The system of claim 8 , wherein the memory device further includes instructions that are executable by the processing device for causing the processing device to, prior to monitoring the repository for the updated version of the first container-image:
receive the alert for the piece of software by accessing a database of alerts;
in response to receiving the alert, determine that the alert meets one or more predefined criteria in a customizable rule set by analyzing the alert;
based on determining that the alert meets the one or more predefined criteria, determine that the piece of software is to be updated;
and
based on determining that (i) the piece of software is to be updated and (ii) the first container-image includes the piece of software, flag the first container-image for monitoring.

10. The system of claim 9 , wherein the one or more predefined criteria comprises at least one of (i) the piece of software being a predefined piece of software; (ii) a product related to the piece of software being a predefined product; (iii) a severity level of the alert being a predefined severity-level; (iv) a date related to the alert being a predefined date; or (v) a programming language related to the piece of software being a predefined programming language.

11. The system of claim 9 , wherein the memory device further includes instructions that are executable by the processing device for causing the processing device to:
based on flagging the first container-image for monitoring, monitor the repository to detect when the first container-image is updated; and
detect that the first container-image was updated based on the updated version of the first container-image being stored in the repository.

12. The system of claim 8 , wherein the memory device further includes instructions that are executable by the processing device for ca

Assignees

• Red Hat Inc

Inventors

• Griffin Leigh
• Coady Stephen

Classifications

• G06F11/0766

  Error or fault reporting or storing · CPC title

• G06F8/71

  Version control (security arrangements therefor G06F21/57); Configuration management · CPC title

• G06F8/65 Primary

  Updates (security arrangements therefor G06F21/57) · CPC title

• G06F11/3688

  for test execution, e.g. scheduling of test suites · CPC title

• G06F9/455

  Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines · CPC title