Managing container applications using registration databases of managed container base images

Abstract

A computer-executed method for managing container applications, comprising the following procedure: Providing a registry database of managed container base images (320) by one or more computer processors, wherein each managed container base image is created by wrapping (220) such that it contains an injection point; Determining, by one or more computer processors, that a managed container base image contains an initial security vulnerability; Creating a patch script by one or more computer processors to address the first security vulnerability; Insertion (240) of the patch script at the injection point of the managed container base image by the one or more computer processors; and After injecting the patch script at the injection point of the managed container base image, issuing (260) a restart command for an application using the managed container base image to a container orchestration tool through one or more computer processors to extract the managed container base image and recreate the managed container base image by executing the first patch script.

Description

BACKGROUND

[0001] The disclosure generally relates to managing software updates. More specifically, the disclosure relates to providing updates for software running in a cloud-based container.

[0002] Cloud-based application containers offer users a computing option that requires fewer resources than a virtual machine. Containers allow users to run software using access to a subset of a host machine's resources. A user / client can deploy a container for use with a base operating system image obtained from a service provider.

[0003] The document US 2018 / 0 088 926 A1 relates to a method comprising: receiving a request for an updated version of a container image from a client device, wherein the request comprises an identification of a previous version of the container image; determining a delta between container layers of the previous version of the container image and the updated version of the container image; generating, based on the delta, a patch for generating the updated version of the container image when the patch is applied to the previous version of the container image; and transferring the patch to the client device.

[0004] The document US 2016 / 0 216 948 A1 relates to a method comprising: invoking source-to-image (STI) orchestration logic to perform a build of an application image for an application of a multi-tenant platform-as-a-service (PaaS) system; starting a build container for the build using a base image providing core functionality of the application by a processing device using the STI orchestration logic; accessing the source code of the application at the build container; assembling the application image by the processing device at the build container using the base image and the source code, wherein the base image comprises a compilation script to cause the assembly of the application image in the build container; and transferring the application image to a repository. SUMMARY

[0005] Aspects of the invention disclose methods, systems, and computer-readable media associated with managing container applications by providing a registry of managed container base images, each managed container base image wrapped to include an injection point, determining that a managed container base image contains a security vulnerability, and creating a patch script to address the vulnerability. Managing container applications further includes injecting the patch script at the injection point and issuing an extraction command for an application using the managed container base image to a container orchestration tool. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings, in which: Fig. 1 provides a schematic representation of a system according to an embodiment of the invention. Fig. 2 provides a flowchart illustrating a sequence of operations according to a preferred embodiment of the invention. Fig. 3 provides a schematic illustration of image development according to an embodiment of the invention. Fig. 4 provides a graphical representation of flow activities according to an embodiment of the invention. Fig. 5 shows a cloud computing environment according to an embodiment of the invention. Fig. 6 shows abstraction model layers according to an embodiment of the invention. DETAILED DESCRIPTION

[0007] By deploying an application container with a base image from a service provider, a user is provided with a pre-installed, pre-structured set of content. Patching and updating the container system is the responsibility of the user, not the service provider. Because container storage is volatile, changes made to the image and the application are lost when the container stops running or is restarted. Changes must be made to the underlying deployment image to take effect.

[0008] In one embodiment, a cloud resource provider (CSP) receives a request for a container base image from a user. This request may be for a managed image or simply for a specific container image. The request may be for a specific container image (i.e., a Docker image) to be managed and made available through a private image registry. The CSP obtains the base image either from a public image registry or from a known private image registry. The CSP then creates a managed version of the requested image file and points the user to the managed version of the file in the private registry.Subsequent queries regarding the base image with a managed version are answered by pointing the user directly to the managed version of the image in the private registry database.

[0009] The base image consists of a series of layers created during a build process. This process records changes to the system's file system associated with command execution in a file that defines the container's environment. All changes associated with each command executed from the file are recorded as a layer of the final base image.

[0010] The system passes the base image to an image analyzer, which discovers and catalogs the image layers. The image analyzer examines the chain of container-base-image layers and detects the root-layer operating system (OS). The system creates an exact copy of the base image, supplemented with an injection point corresponding to the root-layer OS encoding. The new, managed version of the base image is then stored in a private registry database with a name indicating that it is a managed version of a base image. The location, or tag, of the managed version is provided to the user to refer to the managed image. Using the added injection point, the system can update, patch, or otherwise modify the underlying base image within the new, managed version of the base image.

[0011] The user then deploys one or more containers using the managed image and a container orchestration software tool, such as Kubernetes. The user can modify / extend the managed image by adding their own individual configurations to the image according to their needs and application requirements.

[0012] In one embodiment, the system determines that an operating system- or application-related code vulnerability affects at least a portion of the managed images stored in the private registry / catalog. The vulnerability may be detected due to updates released by operating system and application publishers. The system creates operating system- and / or application-specific patch scripts to address the vulnerability. The system of the method forwards each affected image from the private registry / catalog to a patch injection component of the system. The patch injection component inserts the lines of the created patch script into the images at the injection point.

[0013] The patched managed image is then published to the private registry in place of the previous version of the managed image. The patched image has the same location (tag) as the original managed image. After publishing, either a manual or automatic application restart command is issued for all affected application containers. The application restarts and extracts the updated managed image from the private registry, and the application begins running using the updated image. The container image is rebuilt with the patch upon restart.

[0014] In one embodiment, a cloud service provider (CSP) identifies a container image. The CSP may receive a request from a user for a specific container image, or the user may provide the image. This may be a request for a managed image or simply a request for a specific container image. The CSP obtains the base image either from a public image registry, from the user, or from a known private image registry. The CSP then creates a managed version of the requested image file, stores the managed version in the registry, and points the user to the managed version of the file in the private registry. Subsequent requests for the base image are answered by pointing the user directly to the managed version of the image in the private registry.In this embodiment, the CSP modifies the base image by wrapping it by adding an injection point and calling a centralized component. When this component is called during container instance creation, it queries whether a managed image corresponding to the image being relaunched exists. If so, the updated managed image is pushed out, and the image is rebuilt with the update.

[0015] In one embodiment, users submit a specific image request to a service with the knowledge that the service provides managed images. In this embodiment, the user's image request is fulfilled without indicating that the provided image is a managed image.

[0016] In one embodiment, the user can set update defaults to maintain control over individual software versions of the components used to build the base image. In this embodiment, the user can set boundaries regarding allowed and disallowed update versions using semantic versioning defaults. (For example, the user can specify that any update version 7.* is allowed, but no update version 8.* is allowed.)

[0017] In one embodiment, the user can specify segments of the base image for which updates are allowed and segments for which updates are not allowed. When it comes to security vulnerabilities and updates, appropriately segmented patches are forwarded to the patch injection component, and each user's images are rebuilt according to the user's update preferences. In one embodiment, the user sets a preference for automatic updates or manual updates. Images with automatic updates are rebuilt, and reboot commands are automatically sent to the user's system. Images with manual updates are patched and sent to the user with a notice of the update and instructions, allowing the user to accept or reject the patched image.

[0018] In one embodiment, the user can provide application-level information for their requested image. In one embodiment, the service can provide updates and patches for the application and / or its dependencies on the image, as well as for the operating system underlying the image. In this embodiment, the system can provide a managed image with an injection point for injecting updates and patches, or the service provider can provide a managed image with system polling statements for periodically checking for updates and patches.

[0019] Fig. Figure 1 shows a schematic representation of exemplary network resources associated with practicing the disclosed inventions. The inventions may be practiced in the processors of any of the disclosed elements that process an instruction data stream. As shown in the figure, a networked client device 110 connects wirelessly to a server subsystem 102. A client device 104 connects wirelessly to the server subsystem 102 via a network 114. The client devices 104 and 110 include container orchestration programs 106, 112, along with sufficient computing resources (processor, main memory, network data transmission hardware) to execute the programs. As shown in Fig. 1, the server subsystem 102 includes a server computer 150. The server computer 150 stores the catalog / registry database of managed container images. Fig. Figure 1 shows a block diagram of components of the server computer 150 within a networked computer system 1000 according to an embodiment of the present invention. It should be noted that Fig. 1 merely provides an illustration of one implementation and does not impose any limitations on the environments in which various embodiments may be implemented. Many variations may be made to the depicted environment.

[0020] The server computer 150 may include one or more processors 154, a cache memory 162, a main memory 158, persistent storage 170, a data transfer unit 152, one or more input / output (I / O) interfaces 156, and a data transfer network 140. The data transfer network 140 provides data transfers between the cache memory 162, the main memory 158, the persistent storage 170, the data transfer unit 152, and the input / output (I / O) interface(s) 156. The data transfer network 140 may be implemented using any architecture designed to pass data and / or control information between processors (such as microprocessors, data transfer and network processors, etc.), system memory, peripherals, and any other hardware components within the system. For example, the data transmission network 140 may be implemented with one or more buses.

[0021] Main memory 158 and persistent storage 170 are computer-readable storage media. In this embodiment, main memory 158 includes random access memory (RAM) 160. In general, main memory 158 may include any volatile or non-volatile computer-readable storage medium. Cache memory 162 is a fast memory that enhances the performance of processor(s) 154 by maintaining recently accessed data from main memory 158 and data near recently accessed data.

[0022] Program instructions and data used to practice embodiments of the present invention, e.g., a container image management program 175, are stored in persistent storage 170 for execution and / or access by one or more of the respective processors 154 of server computer 150 via cache memory 162. Persistent storage 170 also contains the catalog of managed images 178 used by the disclosed invention and application containers 107 and 113 for devices 104 and 110. In this embodiment, persistent storage 170 includes a magnetic hard disk drive.Alternatively, or in addition to a magnetic hard disk drive, the persistent storage 170 may include a solid-state hard disk drive, a semiconductor memory device, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, or any other computer-readable storage medium capable of storing program instructions or digital information.

[0023] The media used by persistent storage 170 may also be removable. For example, a removable disk drive may be used for persistent storage 170. Other examples include optical and magnetic disks, thumb drives, and smart cards that are inserted into a drive for transfer to another computer-readable storage medium that is also part of persistent storage 170.

[0024] In these examples, the communications unit 152 provides for data transmission to other computing systems or devices, including resources of the client computing devices 104 and 110. In these examples, the communications unit 152 includes one or more network interface cards. The communications unit 152 may provide data transmissions using physical and / or wireless communications links. Software distribution programs and other programs and data used to implement the present invention may be downloaded to the persistent storage 170 of the server computer 150 via the communications unit 152.

[0025] The one or more I / O interfaces 156 enable the input and output of data from / to other devices that may be connected to the server computer 150. For example, the one or more I / O interfaces 156 may provide a connection to one or more external devices 190, such as a keyboard, a numeric keypad, a touchscreen, a microphone, a digital camera, and / or another suitable input device. The one or more external devices 190 may also include portable, computer-readable storage media, such as thumb drives, portable optical or magnetic disks, and memory cards. Software and data used to practice embodiments of the present invention, e.g.The container image management program 175 on the server computer 150 may be stored on such portable, computer-readable storage media and loaded into the persistent storage 170 via the I / O interface(s) 156. The one or more I / O interfaces 156 are also connected to a display 180.

[0026] The display 180 provides a mechanism for displaying data to a user and may, for example, be a computer monitor. The display 180 may also function as a touchscreen, such as a tablet computer display.

[0027] Fig. 2 provides a flowchart 200 illustrating example activities associated with applying the disclosure. After program startup, the system receives a request from a user for a container base image at 210. In one embodiment, the request may be received from system image management software located on a cloud-based server. For requested images with an existing managed version, the system directs the user to the location of the associated managed version of the base image in a private registry database (not shown). The user may provide a base image that is currently in use rather than requesting a new image. The system creates a managed version of the base image at 220 by analyzing the layers of the base image and adding an injection point to the base image.The system publishes the created managed version of the base image to a private image registry and provides the user with the location of the managed version of the base image at 230. If necessary, the system updates or patches the version of the managed image at 240 by inserting appropriate code at the injection point, creating a new version of the managed image. The system publishes the new version of the managed image to the location of the previous version in the private registry at 250. At 260, the system issues a restart command for all affected container applications. When the restart command is executed, the patched version of the managed image is extracted from the private image registry.When the application is restarted, the patch code is executed and the image is rebuilt without the vulnerability, thus providing the user with the benefit of the update / patch.

[0028] In one embodiment, the system maintains a catalog of managed container base images. Each managed image is wrapped to include a code injection point. Multiple versions of a single base image may be stored in the catalog / registry database. Each of the multiple versions may contain its own set of patches to address one or more security vulnerabilities of the underlying base image. Each of this plurality may contain different update levels for the layers of the underlying base image. In this embodiment, a user may request a base image that includes settings for updating the layers that are acceptable to the user. The user may be provided with a managed image that includes only the acceptable updates. The user may choose to manually accept future image updates as they become available.In this embodiment, the managed image is provided to the user with code that allows them to accept or reject future updates / patches. In one embodiment, the managed images include code that periodically polls the catalog for update notifications. In this embodiment, no extract or reboot instructions are issued to the user for new patches / updates to the managed image.

[0029] Fig. Figure 3 illustrates an embodiment of the invention. As shown in the figure, a client image XYZ, 310, is deployed, comprising the CENTOS 1.0, APACHE 1.0, and Client Enhance 1.0 layers. According to the embodiment, a managed version of XYZ, managed.XYZ, 320, which includes an injection point, the SP layer, is created and made available to the client. After the system detects that an update is necessary, patching code is inserted at the SP layer and the image is rebuilt, creating a new version of managed.XYZ, 330. (Note: The terms "CENTOS," "APACHE," "KUBERNETES," and "DOCKER" may be subject to trademark rights in various jurisdictions around the world and are used herein only in reference to the products or services properly designated by the trademarks, to the extent such trademark rights exist.)

[0030] Fig. Figure 4 provides a graphical representation of a system architecture 400 and data flow according to an embodiment of the invention. As shown in the figure, the system 410 determines that a security vulnerability exists and generates a patch 415 to address the vulnerability. A patch analyzer 420 receives the patch and checks the managed image catalog 430, retrieving managed images that require the patch. A patch inserter 440 receives the patch and the relevant images from the patch analyzer 420 and inserts the patch into the managed images at the insertion point, creating an updated image 445. The system sends the patched managed image 445 to a private registry 460 for user access.A user container orchestration element 470 receives instructions to reboot the image from the system 410 and extracts the patched image from the private registry 460 and rebuilds the image, executing the patch code.

[0031] It should be understood at the outset that, although this disclosure includes a detailed description of cloud computing, the implementation of the teachings herein is not limited to a cloud computing environment. Rather, embodiments of the present invention may be practiced in conjunction with any type of computing environment now known or later invented.

[0032] Cloud computing is a service delivery model for enabling seamless, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with a service provider. This cloud model can include at least five characteristics, at least three service models, and at least four implementation models.

[0033] The properties are as follows: On-demand self-service: A cloud user can unilaterally and automatically provision data processing functions such as server time and network storage as needed, without requiring human interaction with the service provider. Broad Network Access: Functions are available over a network and accessed through standard mechanisms that support use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs). Resource pooling: The provider's computing resources are pooled to serve multiple users using a multi-tenant model, with various physical and virtual resources dynamically allocated and reassigned as needed. There is a perceived location independence, as the user generally has no control or knowledge over the exact location of the provided resources, but may be able to specify a location at a higher level of abstraction (e.g., country, state, or data center). Rapid Elasticity: Features can be deployed quickly and elastically for rapid horizontal scaling out, in some cases automatically, and released quickly for rapid scale-in. To the user, the features available for deployment often appear unlimited, and they can be purchased in any quantity at any time. Measured Service: Cloud systems automatically control and optimize resource usage by leveraging a measurement function at a certain level of abstraction appropriate for the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, creating transparency for both the provider and the user of the service.

[0034] The service models are as follows: Software as a Service (SaaS): The functionality provided to the user is to use the provider's applications running on a cloud infrastructure. The applications are accessible from various client devices via a thin client interface such as a web browser (e.g., web-based email). The user does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application functions, with the possible exception of limited user-specific application configuration settings. Platform as a Service (PaaS): The functionality provided to the user is to deploy applications created or obtained by the user, using programming languages ​​and tools supported by the provider, into the cloud infrastructure. The user does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but has control over the deployed applications and possibly over configurations of the application hosting environment. Infrastructure as a Service (IaaS): The functionality provided to the user consists of providing processing, storage, networking, and other basic computing resources, allowing the user to deploy and run any software, including operating systems and applications. The user does not manage or control the underlying cloud infrastructure, but has control over operating systems, storage, deployed applications, and possibly limited control over selected network components (e.g., host firewalls).

[0035] The deployment models are as follows: Private Cloud: The cloud infrastructure is operated solely for an organization. It can be managed by the organization or a third party and can be located on its own premises or on a third-party site. Community Cloud: The cloud infrastructure is shared by multiple organizations and supports a specific user community with common concerns (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organizations or a third party and can be located on their own premises or on someone else's premises. Public Cloud: The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization that sells cloud services. Hybrid Cloud: Cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain separate entities but are interconnected by a standardized or proprietary technology that enables data and application portability (e.g., cloud targeting for load balancing between clouds).

[0036] A cloud computing environment is service-oriented, focusing on state independence, low coupling, modularity, and semantic interoperability. At the heart of cloud computing lies an infrastructure consisting of a network of interconnected nodes.

[0037] With reference to Fig. 5 depicts an illustrative cloud computing environment 50. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud users, such as a personal digital assistant (PDA) or cellular phone 54A, a desktop computer 54B, a laptop computer 54C, and / or an automotive computer system 54N, can communicate. The nodes 10 can communicate with each other. They can be physically or virtually grouped into one or more networks, such as private, community, public, or hybrid clouds (not shown), as described above, or a combination thereof. This enables the cloud computing environment 50 to offer infrastructure, platforms, and / or software as a service, for which a cloud user does not need to maintain resources on a local computing device.It should be noted that the types of in . Fig. 5 are intended to be merely illustrative, and that the computing nodes 10 and the cloud computing environment 50 may communicate with any type of computer-based device via any type of network and / or via any type of network-accessible connection (e.g., using a web browser).

[0038] With reference to Fig. 6 shows a set of functional abstraction layers used by the cloud computing environment 50 ( Fig. 5) are provided. It should be clear from the outset that the Fig. The components, layers, and functions shown in Figure 6 are intended to be illustrative only, and embodiments of the invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0039] A hardware and software layer 60 includes hardware and software components. Examples of hardware components include: mainframe computers 61; Reduced Instruction Set Computer (RISC) architecture-based servers 62; servers 63; blade servers 64; storage units 65; and networks and network components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0040] A virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 71, virtual storage 72, virtual networks 73, including virtual private networks, virtual applications and operating systems 74; and virtual clients 75.

[0041] In one example, a management layer 80 may provide the functions described below. Resource provisioning 81 provides for the dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking when using resources within the cloud computing environment, as well as billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud users and tasks, as well as protection for data and other resources. A user portal 83 provides users and system administrators with access to the cloud computing environment.Service level management 84 provides the allocation and management of cloud computing resources so that the required service objectives are met. Service level agreement (SLA) planning and fulfillment 85 provides the pre-arranging and procurement of cloud computing resources for which future requirements are anticipated, in accordance with an SLA.

[0042] A workload layer 90 provides examples of the functionality for which the cloud computing environment can be used. Examples of workloads and functions that can be provided by this layer include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analytics processing 94; transaction processing 95; and a container image management program 175.

[0043] The present invention may be a system, a method, and / or a computer program product. The invention may be advantageously applied in any single or parallel system that processes a stream of instructions. The computer program product may comprise a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to perform aspects of the present invention.

[0044] The computer-readable storage medium may be any physical device that can retain and store instructions for use by an instruction-executing system. The computer-readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of the computer-readable storage medium includes the following: a portable computer diskette, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM).Flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disc (DVD), memory stick, floppy disk, mechanically encoded device such as punched cards or raised structures in a groove on which instructions are stored, and any suitable combination thereof. A computer-readable storage medium, as used herein, shall not be construed as carrying transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., pulses of light traveling through fiber optic cables), or electrical signals carried through a wire.

[0045] Computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to respective computing / processing units or to an external computer or storage unit via a network such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may include copper transmission cables, fiber optic transmission lines, wireless transmission, routers, firewalls, switching units, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing unit receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium within the respective computing / processing unit.

[0046] Computer-readable program instructions for performing operations of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, integrated circuit configuration data, or either source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, or the like, as well as conventional procedural programming languages ​​such as the C programming language or similar programming languages.The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In the latter case, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, over the Internet using an Internet service provider).In some embodiments, electronic circuits, including, for example, programmable logic circuits, field programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute the computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuits to perform aspects of the present invention.

[0047] Aspects of the present invention are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowcharts and / or block diagrams, as well as combinations of blocks in the flowcharts and / or block diagrams, may be implemented by computer-readable program instructions.

[0048] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that the instructions, executed by the processor of the computer or other programmable data processing apparatus, produce a means for implementing the functions / steps defined in the flowchart block(s) and / or block diagrams.These computer-readable program instructions may also be stored on a computer-readable storage medium that can direct a computer, a programmable data processing apparatus, and / or other devices to function in a particular manner, such that the computer-readable storage medium having instructions stored thereon comprises an article of manufacture, including instructions that implement aspects of the function / step specified in the flowchart block(s) and / or block diagrams.

[0049] The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of process steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-executable process such that the instructions executing on the computer, other programmable apparatus, or other device implement the functions / steps defined in the block(s) of flowcharts and / or block diagrams.

[0050] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions comprising one or more executable instructions for performing the particular logical function(s). In some alternative implementations, the functions indicated in the block may occur in a different order than shown in the figures. For example, two blocks shown in succession may actually execute substantially concurrently, or the blocks may sometimes execute in reverse order depending on the corresponding functionality.It is further understood that each block of the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by special purpose hardware-based systems that perform the specified functions or steps, or by combinations of special purpose hardware and computer instructions.

[0051] The descriptions of the various embodiments of the present invention have been presented for the purpose of illustration, but are not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the invention. The terminology used herein has been chosen to best explain the principles of the embodiment, practical application, or technical improvement over technology found in the marketplace, or to enable others skilled in the art to understand the embodiments presented herein.

Claims

[1] A method executed on a computer for managing container applications, the method comprising: Providing, by one or more computer processors, a registry of managed container base images (320), each managed container base image being wrapped (220) to include an injection point; Determining, by the one or more computer processors, that a managed container base image contains a first security vulnerability; Creation of a patch script by the one or more computer processors to address the first security vulnerability; inserting (240) the patch script at the injection point of the managed container base image by the one or more computer processors; and after inserting the patch script at the injection point of the managed container base image, issuing (260) a restart command for an application using the managed container base image to a container orchestration tool by the one or more computer processors to extract the managed container base image and rebuild the managed container base image by executing the first patch script. [2] A computer-implemented method according to claim 1, further comprising: Receiving, by the one or more computer processors, a request for a first container base image; Determining, by the one or more computer processors, that the first container base image is unmanaged; and Creating a managed version of the first container base image by the one or more computer processors. [3] The computer-executed method of claim 2, wherein the managed version of the first container base image comprises the first container base image wrapped to include an injection point. [4] A computer-implemented method according to claim 3, further comprising: determining, by the one or more computer processors, that the managed version of the first container base image contains a second security vulnerability; Creating, by the one or more computer processors, a patch script to address the second security vulnerability; inserting the patch script at the injection point of the managed version of the first container base image by the one or more computer processors, resulting in a patched first container base image; and Publishing the patched first container base image by the one or more computer processors. [5] A computer-implemented method according to claim 1, further comprising: determining, by the one or more computer processors, a set of managed images affected by the first vulnerability; Patching each managed image from the set by the one or more computer processors; and Publishing each patched managed image by the one or more computer processors. [6] The computer-implemented method of claim 1, further comprising enabling a user to reject the extraction command. [7] A computer-implemented method according to claim 1, further comprising: Determining, by the one or more computer processors, that the container base image is unmanaged; Creating, by the one or more computer processors, a managed version of the container base image, wherein the managed version of the container base image has an injection point; and Enabling, by the one or more computer processors, a user to reject the extraction command. [8] A computer program product for managing the execution of an application, the computer program product comprising one or more computer-readable storage units and program instructions stored thereon for carrying out a method according to any one of the preceding claims. [9] A computer system (150, 410) for managing the execution of an application, the computer system comprising: one or more computer processors (154); one or more computer-readable storage units (170); stored program instructions (175) on the one or more computer-readable storage units for carrying out a method according to any one of claims 1 to 7 by the one or more computer processors.

Images