Validation of container images

Patent metadata

Field	Value
Publication number	US-12405923-B2
Application number	US-202318488179-A
Country	US
Kind code	B2
Filing date	Oct 17, 2023
Priority date	Oct 17, 2023
Publication date	Sep 2, 2025
Grant date	Sep 2, 2025

Abstract

A computing device receives a container image from a container registry, the container image comprising a plurality of layers. The computing device extracts, from the container image, a plurality of files into a filesystem of the computing device, each file of the plurality of files corresponding to one of the layers of the plurality of layers. The computing device generates a metadata file that describes a directory structure of the plurality of files in the filesystem. The computing device mounts the metadata file to a location in the filesystem, wherein mounting the metadata file causes a digest of the metadata file to be generated and the metadata file and the plurality of files in the filesystem to be read-only.

First claim

What is claimed is:

1. A method, comprising:
extracting, by a computing system executing a kernel based operating system, a plurality of files from a container image into a filesystem of a container registry of the computing system, the container image comprising a plurality of layers, each file of the plurality of files corresponding to one of the layers of the plurality of layers;
generating, by the computing system, a metadata file that comprises a directory structure of the plurality of files in the filesystem of the container registry, wherein the directory structure points to a plurality of file locations from which the plurality of files can be respectively accessed within the filesystem of the container registry, and wherein the metadata file does not include contents of the plurality of files in the filesystem;
mounting, by the computing system in a kernel of the kernel-based operating system, the metadata file to a mount point, wherein mounting the metadata file causes a first digest of the metadata file to be generated and the metadata file and the plurality of files in the filesystem of the container registry to be read-only, wherein the first digest comprises cryptographic information that identifies a plurality of digests of the plurality of files in the filesystem, and wherein mounting the metadata file further causes a file of the plurality of files to be pulled to the mount point from a first file location of the plurality of file locations pointed to by the metadata file;
subsequent to mounting the metadata file to the mount point, determining, by the computing system, that the filesystem is being accessed;
responsive to determining that the filesystem is being accessed, generating, by the computing system, a second digest of the metadata file;
determining, by the computing system based on a comparison of the first digest to the second digest, that the directory structure of the plurality of files in the filesystem has not changed; and
responsive to determining that the directory structure of the plurality of files has not changed, instantiating, by the computing system, a container using the file pulled to the mount point from the first file location.

2. The method of claim 1 , wherein mounting the metadata file further causes the plurality of digests to be generated and the metadata file to include the plurality of digests.

3. The method of claim 2 , further comprising:
subsequent to mounting the metadata file to the mount point, determining that a particular file of the plurality of files in the filesystem is being accessed;
obtaining, from the metadata file, a third digest of the plurality of digests, the third digest corresponding to the particular file; and
determining that a current digest of the particular file matches or does not match the third digest corresponding to the particular file.

4. The method of claim 3 , further comprising:
determining that there is a match between the current digest of the particular file and the third digest corresponding to the particular file; and
verifying, based on the match, that the particular file has not been changed.

5. The method of claim 3 , further comprising:
determining that there is not a match between the current digest of the particular file and the third digest corresponding to the particular file; and
sending a message indicating an error in the particular file.

6. The method of claim 1 , further comprising:
accessing the plurality of files in the filesystem; and
obtaining, from the metadata file, the plurality of digests.

7. The method of claim 6 , further comprising, for each file of the plurality of files:
subsequent to obtaining the plurality of digests, determining that there is a match between a current digest of the file and a corresponding digest of the plurality of digests, wherein a manifest file of the container image includes the current digest of each file of the plurality of files; and
verifying, based on the match, that the file has not been changed.

8. The method of claim 6 , further comprising:
subsequent to obtaining the plurality of digests, determining that there is not a match between at least one current digest of a particular file of the plurality of files and a corresponding digest of the plurality of digests, wherein a manifest file of the container image includes a current digest of each file of the plurality of files; and
sending a message indicating an error in the container image.

9. The method of claim 1 , further comprising:
subsequent to mounting the metadata file to the mount point, storing the first digest of the metadata file in a location on the computing system.

10. The method of claim 1 , wherein the metadata file includes one or more of characteristics of the filesystem, characteristics of each file of the plurality of files, or a layout of the filesystem.

11. A computing system, comprising:
a memory;
one or more processor devices coupled to the memory, the one or more processor devices to:
extract, from a container image, a plurality of files into a filesystem of a container registry of the computing system, the container image comprising a plurality of layers, each file of the plurality of files corresponding to one of the layers of the plurality of layers;
generate a metadata file that comprises a directory structure of the plurality of files in the filesystem of the container registry, wherein the directory structure points to a plurality of file locations from which the plurality of files can be respectively accessed within the filesystem of the container registry, and wherein the metadata file does not include contents of the plurality of files in the filesystem;
mount the metadata file to a mount point, wherein mounting the metadata file causes a first digest of the metadata file to be generated and the metadata file and the plurality of files in the filesystem of the container registry to be read-only, wherein the first digest comprises cryptographic information that identifies a plurality of digests of the plurality of files in the filesystem, and wherein mounting the metadata file further causes a file of the plurality of files to be pulled to the mount point from a first file location of the plurality of file locations pointed to by the metadata file;
subsequent to mounting the metadata file to the mount point, determine that the filesystem is being accessed;
responsive to determining that the filesystem is being accessed, generate a second digest of the metadata file;
determine, based on a comparison of the first digest to the second digest, that the directory structure of the plurality of files in the filesystem has not changed; and
responsive to determining that the directory structure of the plurality of files has not changed, instantiate a container using the file pulled to the mount point from the first file location.

12. The computing system of claim 11 , wherein to mount the metadata file, the one or more processor devices are further to cause the plurality of digests to be generated and the metadata file to include the plurality of digests.

13. The computing system of claim 12 , wherein the one or more processor devices are further to:
subsequent to mounting the metadata file to the mount point, determine that a particular file of the plurality of files in the filesystem is being accessed;
obtain, from the metadata file, a third digest of the plurality of digests, the third digest corresponding to the particular file; and
determine that a current digest of the particular file matches or does not match the third digest corresponding to the particular file.

14.

Assignees

• Red Hat Inc

Inventors

• Scrivano Giuseppe
• Larsson Alexander

Classifications

• G06F11/3086

  where the reporting involves the use of self describing data formats, i.e. metadata, markup languages, human readable formats · CPC title

• G06F11/0769

  Readable error formats, e.g. cross-platform generic formats, human understandable formats · CPC title

• G06F9/545

  where tasks reside in different layers, e.g. user- and kernel-space · CPC title

• G06F16/164 Primary

  File meta data generation · CPC title

• G06F16/11 Primary

  File system administration, e.g. details of archiving or snapshots (error detection or correction of the data by redundancy in operations G06F11/14) · CPC title