Container packaging device

Patent metadata

Field	Value
Publication number	US-11062022-B1
Application number	US-201916400170-A
Country	US
Kind code	B1
Filing date	May 1, 2019
Priority date	May 1, 2019
Publication date	Jul 13, 2021
Grant date	Jul 13, 2021

Abstract

A method for generating a software container includes receiving a software application and a containerization file. The method also includes building an image file using the containerization file, the image file containing the software application. The method also includes recording, in the image file, an image lineage. The method also includes performing a security scan of the image file to obtain a result, the security scan comprising checking the image file for inadequacies. The method also includes assigning, to the image file, a security level selected from among a plurality of different predetermined security levels. Assigning is based on a combination of the image lineage and the result of the security scan. The method also includes signing the image file with the security level to create a signed image file. The method also includes storing the signed image file as the software container.

First claim

What is claimed is:

1. A method for generating a software container, the method comprising:
receiving a software application and a containerization file;
building an image file using the containerization file, the image file containing the software application;
recording, in the image file, an image lineage;
performing a security scan of the image file to obtain a result, the security scan comprising checking the image file for inadequacies;
assigning, to the image file, a security level selected from among a plurality of different predetermined security levels,
wherein assigning is based on a combination of the image lineage and the result of the security scan;

signing the image file with the security level to create a signed image file; and
storing the signed image file as the software container.

2. The method of claim 1 , further comprising:
testing the image file prior to recording the image lineage.

3. The method of claim 1 , further comprising:
performing a container structure test on the image file after recording the image lineage and prior to performing the security scan of the image file, and
wherein assigning is further based on a container structure test result.

4. The method of claim 1 , wherein the security scan is performed by a remote security scanning tool.

5. The method of claim 4 , further comprising:
publishing the signed image file to an artifact repository manager.

6. The method of claim 5 , wherein the plurality of different predetermined security levels comprises a first security level, a second security level, and a third security level, wherein the first security level comprises a highest security level, the second security level comprises a middle security level less secure than the first security level, and the third security level comprises a lowest security level less than the second security level.

7. The method of claim 6 further comprising:
publishing the signed image file to the artifact repository manager as a development software container when the security level comprises the second security level or the third security level; and
publishing the signed image file to the artifact repository manager as a released software container when the security level comprises the first security level.

8. The method of claim 7 further comprising:
deleting the image file after publishing the software container as either the development software container or the released software container.

9. A system comprising:
a data repository storing a software application and a containerization file;
an image file builder configured to:
build, using the containerization file, an image file containing the software application,
record an image lineage for the image file, and
add the image lineage to the image file;

a decision engine configured to:
receive a security scan result produced as a result of performing a security scan on the image file with the image lineage,
determine a security level of the image file based on a combination of the image lineage and the security scan result, the security level selected from a plurality of pre-determined security levels, and
sign the image file with the security level to form a signed image file; and

a publisher configured to publish the signed image file to an artifact repository manager based on the security level identified in the signed image file.

10. The system of claim 9 , wherein the publisher is further configured to publish the signed image file to the artifact repository manager as one of a development software container available only for software development or a released software container available for execution, and wherein the publisher is configured to publish the signed image file as the development software container or the released software container.

11. The system of claim 9 , further comprising:
a security engine configured to send the image file to a remote security scanning tool prior to the decision engine receiving the security scan result, wherein the remote security scanning tool is configured to perform the security scan.

12. The system of claim 9 , further comprising:
a security engine configured to perform the security scan with a scanning tool.

13. The system of claim 12 , further comprising:
a test integrator configured to:
perform structural tests on the image file prior to application of the security engine; and
send the image file, responsive to the structural tests passing, to the security engine.

14. The system of claim 9 , wherein the publisher is further configured to delete the signed image file from a local computer after publishing the signed image file to the artifact repository manager.

15. A non-transitory computer readable medium comprising computer readable program code, the computer readable program code for causing a computer system to:
receive a software application and a containerization file;
build an image file using the containerization file, the image file containing the software application;
record, in the image file, an image lineage;
perform a security scan of the image file to obtain a result, the security scan comprising checking the image file for inadequacies;
assign, to the image file, a security level selected from among a plurality of different predetermined security levels,
wherein assigning is based on a combination of the image lineage and the result of the security scan;

sign the image file with the security level to create a signed image file; and
store the signed image file as a software container.

16. The non-transitory computer readable storage medium of claim 15 , the computer readable program code for further causing the computer system to:
perform a container structure test on the image file after recording the image lineage and prior to performing the security scan of the image file, and
wherein the computer readable program code for causing the computer system to assign is further based on a container structure test result.

17. The non-transitory computer readable storage medium of claim 16 , the computer readable program code for further causing the computer system to:
publish the signed image file to an artifact repository manager.

18. The non-transitory computer readable storage medium of claim 17 , wherein the plurality of different predetermined security levels comprises a first security level, a second security level, and a third security level, wherein the first security level comprises a highest security level, the second security level comprises a middle security level less secure than the first security level, and the third security level comprises a lowest security level less than the second security level.

19. The non-transitory computer readable storage medium of claim 18 , the computer readable program code for further causing the computer system to:
publish the signed image file to the artifact repository manager as a development software container when the security level comprises the second security level or the third security level; and
publish the signed image file to the artifact repository manager as a released software container when the security level comprises the first security level.

Assignees

• Intuit Inc

Inventors

• Kalamkar Amit
• Martirosyan Aram
• Singaram Sriramu

Classifications

• G06F2221/033

  Test or assess software · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F2009/45562

  Creating, deleting, cloning virtual machine instances · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title