Managing software programs

Patent metadata

Field	Value
Publication number	US-11042366-B2
Application number	US-201916411250-A
Country	US
Kind code	B2
Filing date	May 14, 2019
Priority date	May 14, 2019
Publication date	Jun 22, 2021
Grant date	Jun 22, 2021

Abstract

Managing container applications by providing a registry of managed container base images, each managed container base image wrapped to include an injection point, determining that a managed container base image includes a vulnerability, and creating a patch script to address the vulnerability. Managing container applications further includes inserting the patch script at the injection point and issuing a pull command for an application using the managed container base image, to a container orchestration tool.

First claim

What is claimed is:

1. A computer implemented method for managing container applications, the method comprising:
providing, by a services provider, a registry of managed container base images, each managed container base image of the managed container base images comprising an original container base image;
identifying image layers in a layer chain for each original container base image in the managed container based images;
identifying a root layer operating system in the identified image layers for each original container base image in the managed container based images;
appending an injection point to each original container base image in the managed container based images according to coding of the root layer operating system;
determining, by the services provider, that a first managed container base image from the registry of managed container base images includes a first vulnerability;
creating, by the services provider, a first patch script to address the first vulnerability;
inserting, by the services provider, the first patch script at the injection point of the determined first managed container base image to create a patched first managed container based image;
determining, by the services provider, that a second managed container base image from the registry of managed container base images includes a second vulnerability;
creating, by the services provider, a second patch script to address the second vulnerability;
inserting, by the services provider, the second patch script at the injection point of the second managed container base image, resulting in a patched second managed container base image;
issuing, by the services provider, a restart command for an application using the determined first managed container base image to a container orchestration tool to pull the patched first managed container based image and rebuild the determined first managed container base image by executing the first patch script; and
publishing, by the services provider, the patched second managed container base image.

2. The computer implemented method according to claim 1 , further comprising:
receiving, by the services provider, a request for a third container base image;
determining, by the services provider, that the third container base image is not managed; and
creating, by the services provider, a managed version of the third container base image.

3. The computer implemented method according to claim 2 , wherein the managed version of the third container base image comprises the third container base image appended to include an injection point.

4. The computer implemented method according to claim 1 , further comprising:
determining, by the services provider, a set of managed images related to the first vulnerability;
patching, by the services provider, each managed image of the set of managed images using the created first patch script for addressing the first vulnerability; and
publishing, by the services provider, each patched managed image of the set of managed images.

5. The computer implemented method according to claim 1 , further comprising the service provider enabling a user to reject pulling the first or second patched managed container based image.

6. The computer implemented method according to claim 1 , further comprising:
determining, by the services provider, that a fourth container base image is not managed;
creating, by the services provider, a managed version of the fourth container base image, wherein the managed version of the fourth container base image comprises an injection point; and
enabling, by the services provider, a user to reject pulling the managed version of the fourth container based image.

7. A computer program product for managing application execution, the computer program product comprising one or more computer readable storage devices and stored program instructions on the one or more computer readable storage devices, the stored program instructions executed on one or more computer processors comprising:
program instructions for providing a registry of managed container base images, each managed container base image of the managed container base images comprising an original container base image;
program instructions for identifying image layers in a layer chain for each original container base image in the managed container based images;
program instructions for identifying a root layer operating system in the identified image layers for each original container base image in the managed container based images;
program instructions for appending an injection point to each original container base image in the managed container based images according to coding of the root layer operating system;
program instructions for determining that a first managed container base image from the registry of managed container base images includes a first vulnerability;
program instructions for creating a first patch script to address the first vulnerability;
program instructions for inserting the first patch script at the injection point of the determined first managed container base image to create a patched first managed container based image;
program instructions for determining, by the one or more computer processors, that a second managed container base image from the registry of managed container base images includes a second vulnerability;
program instructions for creating, by the one or more computer processors, a second patch script to address the second vulnerability;
program instructions for inserting, by the one or more computer processors, the second patch script at the injection point of the second managed container base image, resulting in a patched second managed container base image;
program instructions for issuing a restart command for an application using the determined first managed container base image, to a container orchestration tool to pull the patched first managed container based image and rebuild the determined first managed container base image by executing the first patch script; and
program instructions for publishing, by the services provider, the patched second managed container base image.

8. The computer program product according to claim 7 , the stored program instructions further comprising:
program instructions for receiving a request for a third container base image;
program instructions for determining that the third container base image is not managed; and
program instructions for creating a managed version of the third container base image.

9. The computer program product according to claim 8 , wherein the managed version of the third container base image comprises the third container base image appended to include an injection point.

10. The computer program product according to claim 7 , the stored program instructions further comprising:
program instructions for determining a set of managed images related to the first vulnerability;
program instructions for patching each managed image of the set of managed images using the created first patch script for addressing the first vulnerability; and
program instructions for publishing each patched managed image of the set of managed images.

11. The computer program product according to claim 7 , the stored program instructions further comprising program instructions for enabling a user to reject pulling the first or second patched managed container based image.

12. The computer program product according to claim 7 , the stored program instructions further comprising:
program instructions for determining that a fourth container base image is not managed;
program instructions for creating a managed version of the

Assignees

• IBM

Inventors

• Gibbs Nathaniel J
• Lobbes Matthew Mitchell
• Snitzer Brian James
• Treadway Michael

Classifications

• G06F2009/45591

  Monitoring or debugging support · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F8/65 Primary

  Updates (security arrangements therefor G06F21/57) · CPC title

• G06F8/63

  Image based installation; Cloning; Build to order · CPC title