Discover and identify containerized software

Abstract

The discovery and identification of containerized software can include discovering a plurality of container remnants by electronically scanning portions of computer memory of at least one computer system of one or more computing nodes, the portions of computer memory being allocated for persistent storage of computer data, and each container remnant containing the computer data providing a record of system-generated execution attributes that occurred in response to the execution of one or more containerized applications. One or more inactive container remnants not in use by currently running containerized applications can be identified from among the plurality of container remnants. Each inactive container remnant is classified, the classification being based on the system-generated execution attributes contained in each inactive container remnant. Based on the classification, previously executed containerized applications can be identified by referencing a database containing data whose structure maps the identities of containerized applications to patterns of execution attributes.

Description

Technical Field

[0001] This disclosure relates to the discovery and identification of software, and more particularly, to the discovery and identification of containerized software.

Background Art

[0002] Containerized software provides a complete runtime environment bundled into a single container or package that includes the application (code) and all dependencies such as configuration files, libraries, and other binaries necessary for the execution of the application. In contrast to virtual machines, containers do not include an individual operating system (OS). Instead, containers access a read-only portion of the OS kernel that can be shared with other containers running on the host machine. As a result, the amount of code and the types of software required for application execution can be reduced, leading to lightweighting. In the context of cloud-based computing, containers are typically quickly deployed, efficiently executed, and easily migrated within a cloud computing environment.

Summary of the Invention

[0003] In one or more embodiments, the method may include discovering a plurality of container remnants by electronically scanning a portion of the computer memory of at least one computer system of one or more computing nodes, the portion of computer memory being allocated to persistent storage for computer data, and each container remnant containing computer data that provides a record of system-generated execution attributes generated in response to the execution of one or more containerized applications. The method may also include identifying one or more inactive container remnants among the plurality of container remnants that are not being used by the currently running containerized application. Furthermore, the method may include classifying each inactive container remnant, the classification being based on the system-generated execution attributes contained in each inactive container remnant. Based on the classification, the method may also include identifying previously executed containerized applications by referring to a database containing data having a structure that maps the identity of a containerized application to a pattern of execution attributes.

[0004] In one or more embodiments, the system includes a processor configured to initiate an operation. The operation may include discovering a plurality of container remnants by electronically scanning a portion of the computer memory of at least one computer system of one or more computing nodes, the portion of computer memory being allocated to persistent storage for computer data, and each container remnant containing computer data that provides a record of system-generated execution attributes generated in response to the execution of one or more containerized applications. The operation may also include identifying one or more inactive container remnants among the plurality of container remnants that are not being used by the currently running containerized application. Furthermore, the operation may include classifying each inactive container remnant, the classification being based on the system-generated execution attributes contained in each inactive container remnant. The operation may also include, based on the classification, identifying previously executed containerized applications by referring to a database containing data having a structure that maps the identity of a containerized application to a pattern of execution attributes.

[0005] In one or more embodiments, a computer program product includes one or more computer-readable storage media having instructions stored thereon. The instructions are executable by a processor to initiate an operation. The operation may include discovering a plurality of container remnants by electronically scanning a portion of the computer memory of at least one computer system of one or more computing nodes, the portion of computer memory being allocated to persistent storage for computer data, and each container remnant containing computer data that provides a record of system-generated execution attributes generated in response to the execution of one or more containerized applications. The operation may also include identifying one or more inactive container remnants among the plurality of container remnants that are not being used by the currently running containerized application. Furthermore, the operation may include classifying each inactive container remnant, the classification being based on the system-generated execution attributes contained in each inactive container remnant. The operation may also include, based on the classification, identifying previously executed containerized applications by referring to a database containing data having a structure that maps the identity of a containerized application to a pattern of execution attributes.

[0006] This summary is provided solely to introduce a particular concept and is not intended to identify any important or essential features of the claimed subject matter. Other features of the arrangement of the present invention will become apparent from the accompanying drawings and the following detailed description.

[0007] The arrangement of the present invention is shown as an example in the accompanying drawings. However, the drawings should not be construed as limiting the arrangement of the present invention to only the specific embodiments shown. Various aspects and advantages will become apparent by considering the detailed description below and referring to the drawings. [Brief explanation of the drawing]

[0008] [Figure 1] An exemplary computing environment is shown, including a compute node for implementing a post-scan tool to identify containerized applications, according to the embodiment. [Figure 2] This figure shows an example of a post-scan tool according to an embodiment. [Figure 3] This is a flowchart illustrating a method for identifying previously executed containerized applications according to an embodiment. [Figure 4] This is a flowchart illustrating a method for identifying containerized applications that are not being used by currently running containerized applications, according to one embodiment. [Figure 5] This is a flowchart illustrating a method for classifying container remnants generated by a previously executed containerized application, according to one embodiment. [Figure 6] This figure shows a cloud computing environment according to an embodiment. [Figure 7] This figure shows an abstraction model layer according to the embodiment. [Figure 8] This figure shows a cloud computing node according to an embodiment. [Modes for carrying out the invention]

[0009] This disclosure concludes with claims defining novel features, but the various features described herein will be better understood by considering this specification in conjunction with the drawings. The processes, machines, manufactures, and any variations thereof described herein are provided for illustrative purposes only. The specific structural and functional details described herein should not be constrained, but rather constrained merely as the basis for the claims and as representative grounds to teach those skilled in the art to employ the described features in various substantially any appropriately detailed structures. Furthermore, the terms and phrases used herein are not intended to be limiting, but rather to provide an easily understandable description of the described features.

[0010] This disclosure relates to the discovery and identification of software, and more specifically, to the discovery and identification of containerized software. A growing number of consumers, particularly large enterprises, are relying on cloud-based, vendor-distributed containerized applications. Many of these applications are based on a microservices architecture, in which the application consists of multiple containers that can run on multiple machines located or distributed in different geographical locations. Containerized software is structured to avoid machine-specific dependencies (e.g., libraries and shared packages). Instead, a container can package the application's code along with libraries, configurations, system tools, or other dependencies, or a combination thereof. Containerization allows an application to use, for example, the same Linux kernel as the computer system on which it runs. Therefore, an application can be deployed using only code and objects that have not yet run on the host. Furthermore, container orchestration systems (such as Kubernetes®) can automate the deployment, scaling, load balancing, and management of containerized applications, and facilitate communication and cooperation between multiple containers.

[0011] While containerized applications offer technical advantages, integrating them into cloud platforms presents challenges for both vendors and consumers. These challenges stem from the fundamental nature of containers: once a containerized application has finished running, the container itself "disappears." That is, an application image is instantiated to create a container for running the application, but once the application is executed, the container is removed from the computer system. Containers are ephemeral. As a result, the identity of the containerized application and proof that the application was executed are also lost.

[0012] Manually tracking the usage of individual containerized applications is often impractical, if not entirely impossible, especially for companies with multiple users who frequently use many different applications. While software asset management (SAM) programs, software probes, or similar tools can be used, they only offer periodic monitoring. Monitoring simply involves periodically examining program samples or snapshots. The more frequently program sampling is performed, the more system resources are used for monitoring, undermining one of the major advantages of containerized applications. Furthermore, even with frequent periodic monitoring, there will be time lags. During these unavoidable time lags, it becomes difficult to track containerized applications distributed by vendors, potentially leading to increased licensing obligations without customer awareness or holding companies liable if their agents misuse the applications.

[0013] This problem could worsen if, as some predict, vendors shift from fixed-term contracts to hourly usage. For example, customers who only use containerized applications a few times or for short periods may not want to be tied to an annual subscription. Therefore, being able to see and track the usage of containerized applications can be essential, especially during the gaps between regular monitoring by probes and other software tools.

[0014] The arrangements described herein are directed towards computer technology and provide improvements to existing computer technology. These arrangements improve computer technology by providing machine-based discovery and identification of previously executed containerized applications that cannot be discovered or identified through periodic monitoring. In the context of running containerized applications using persistent volumes as well as ephemeral volumes, another improvement is a mechanism for deleting persistent volumes, thereby freeing up computing resources when persistent volumes are no longer needed.

[0015] In certain embodiments, the systems, methods, and computer program products disclosed herein operate within a computing environment that includes multiple computer nodes connected via a data communication network for provisioning containerized applications. Operationally, systems according to some embodiments discover one or more container remnants by electronically scanning portions of the computer memory of one or more computer systems. As defined herein, a “container remnant” is a collection of computer data generated by an ongoing or completed execution of a containerized application. The computer data includes system-generated execution attributes that characterize the execution of the containerized application. Execution attributes are the remnants of the execution. As defined herein, “execution attributes” are behaviors, events, parameters, and other data that characterize a particular execution of a containerized application by a computer system.

[0016] It is noteworthy that a container remnant does not identify the containerized application whose execution generated the data it contains. Nevertheless, in one aspect of the systems, methods, and computer program products disclosed herein, a container remnant is used as a clue to discover and identify the containerized application whose previous execution was likely to have generated the container remnant. One aspect of a container remnant is persistent storage. That is, while the container of a containerized application is ephemeral, a container remnant is persistent. A container remnant can consist of a log stream (e.g., log files, configuration files, core dumps, backup files, directories, subdirectories) or, in the context of a container managed by a container orchestration system, a persistent volume. Each such persistent volume, file, or log stream contains execution attributes, which provide records of behavior, events, parameters, and other data characterizing the running or execution of a containerized application on a computer system.

[0017] At any given moment, a container remnant may be used by a currently running containerized application. Therefore, another aspect of the systems, methods, and computer program products disclosed herein is the distinction between persistently stored container remnants that are not used by a currently running containerized application and those that are used by such applications. As defined herein, an “active container remnant” is a container remnant used by a currently running containerized application. An “inactive container remnant” as defined herein is a container remnant that is not being used by a currently running containerized application. Multiple container remnants (different persistent volumes or log streams, or both) not being used by a currently running containerized application may correspond to a previously executed single containerized application, particularly considering the possibility that a composite application might run in multiple containers. Therefore, another aspect of the systems, methods, and computer program products disclosed herein is the classification of inactive container remnants, each classification corresponding to a particular containerized application that has finished running on a computer system or otherwise terminated. The ephemeral container of a containerized application "disappears" (is deleted) when the execution of the containerized application on the computer system is complete or terminated.

[0018] Classification can be performed based on pattern recognition to identify log streams or persistent volumes, or combinations thereof, that have data patterns that are statistically likely to belong to the same category. The systems, methods, and computer program products disclosed herein determine the likely identity of a previously executed containerized application by referring to a database containing a data structure that maps the identity of a containerized application to specific execution attributes. Thus, the data structure provides a kind of fingerprint for identifying a previously executed containerized application.

[0019] The ability to discover and identify previously run containerized applications offers several advantages. For example, it allows for the estimation of potential licensing liabilities for the use of containerized applications. In a multi-user enterprise, for instance, it can identify unauthorized execution of containerized applications. Furthermore, this identification can be used as part of a trend analysis of the types of containerized applications an enterprise might use in the future. Based on such identification, more efficient allocation and maintenance of computing resources can be achieved. For example, efficient allocation of computing resources within a specific context of a container orchestration system may include, as mentioned above, the deletion or removal of persistent volumes that are no longer required to support containerized applications.

[0020] More generally, the ability to identify previously executed containerized applications can be combined or integrated with various software tracing tools used, for example, by system administrators to maintain system security or by technical support experts for debugging purposes. Discovering and identifying containerized applications also provides data for predicting future infrastructure requirements (both hardware and software) to host increased workloads based on trend analysis. Trend analysis can also be used, for example, to optimize the acquisition and renewal of cloud computing licenses.

[0021] Further aspects of the embodiments described within this disclosure are explained in more detail below with reference to the following figures.In order to simplify and clarify the illustration, the elements shown in the figures are not necessarily drawn to scale. For example, the dimensions of some elements may be exaggerated relative to other elements for clarity. Further, where appropriate, reference numerals are repeated between figures to indicate corresponding, similar, or like features.

[0022] FIG. 1 depicts an exemplary computing environment 100. The computing environment 100 is exemplarily configured from a cloud-based computing environment having features such as those described in more detail below with reference to FIGS. 6 and 7. The computing environment 100 includes, exemplarily, a plurality of computing nodes each of which includes some or all of the hardware components (e.g., processors, memories, I / O interfaces, and devices) and computing resources described below with reference to FIG. 8. The computing node(s) 102 can include one or more stand-alone devices (e.g., servers, desktop computers, laptops, tablets, smartphones, smartwatches, etc.) or a computing system that utilizes clustered computers and components that provide a single pool of seamless resources.

[0023] Computing environment 100 also illustratively includes computing nodes 104, 106, and 108. Computing nodes 102 - 108 are communicatively coupled via data communication network 110. Data communication network 110 can be, for example, the Internet, a wide area network (WAN), a local area network (LAN), or a combination thereof or other types of networks or combinations thereof, and can include wired, wireless, fiber optic or other connections or combinations thereof.

[0024] Computing node 104 is composed of one or more cloud - based vendor servers for provisioning containerized application 112 to computing node 102. One or more of the containerized applications 112 can be executed on the request of computing node 102, and the request is transmitted to the cloud - based vendor via data communication network 110. Computing node 106 provides a cloud - based storage device accessible from other computing nodes via data communication network 110. The cloud - based storage device includes persistent storage 114. Persistent storage 114 can include log streams, configuration files, directory structures, sub - directories, core dumps, diagnostic logs, startup records, backup files, etc., all of which record various execution attributes related to the instantiation or execution of containerized applications. In the context of a container orchestration framework such as Kubernetes (trademark), for example, persistent storage 114 can be composed of persistent volumes in addition to or instead of log streams and other types of storage. Collectively, persistent storage 114 (including persistent volumes) is composed of container remnants containing execution attributes as defined above.

[0025] Computing node 108 is an exemplary cloud-based server that stores specific data in application fingerprint database 116. The structure of the data contained in application fingerprint database 116 maps identifiers of specific containerized applications to electronically recorded execution attributes generated by the running (or execution) of containerized computer applications by the computer system, as will be described in more detail below. Thus, each of such data structures functions as a kind of "fingerprint" that maps identifiers of a given application to execution attributes generated by the execution of the containerized application. Collectively, the data structure of application fingerprint database 116 provides a catalog or index for matching containerized applications against patterns of execution attributes.

[0026] The Post-Execution Scan Tool (PST) 120, as described below, is a software tool that refers to the Application Fingerprint Database 116 to discover and identify previously executed containerized applications after the container used to run the containerized application has "disappeared," that is, after the ephemeral container that only exists while the containerized application is running has been removed from the computer system. The PST 120 can be deployed to the cloud by the compute node 102 (for example, at administrator access level) to identify any containerized applications 112 that the compute node will run after the container itself has disappeared after execution.

[0027] Computing environment 100 includes, exemplary, four computing nodes, but it should be apparent that in other embodiments, the computing environment on which PST120 can operate may include more or fewer computing nodes than shown. Furthermore, systems such as vendor provisioning and persistent storage for containerized applications can be integrated into a single computing node and their functions can be performed there. PST120 may also be deployed by the same computing node that stores a database of "fingerprints" for containerized applications. In other embodiments, one or more of computing nodes 102-108 may constitute virtual machines (e.g., virtual servers) for implementing the systems and functions described herein.

[0028] Referring further to Figure 2, specific components of an embodiment of PST120 are depicted. Exemplarily, PST120 consists of a computer memory scanner 210, a container remnant classifier 220, and a containerized application identifier 230. Optionally, PST120 can be deployed in a computing environment 100 (which can be configured as a cloud-based computing environment) at an administrator access level. In a particular embodiment, the computer memory scanner 210, the container remnant classifier 220, and the containerized application identifier 230 are implemented in software running on one or more processors of one or more computer systems, such as the processor 816 of computer system 812, which will be discussed later with reference to Figure 8.

[0029] In operation, the PST120's computer memory scanner 210 electronically scans one or more portions of the computer memory of at least one computer system, where portions of computer memory are allocated to persistent storage of computer data (persistent volumes, log streams, or both). Each container remnant contains computer data that provides a record of system-generated execution attributes generated in response to the execution of one or more containerized applications. The computer memory scanner 210 identifies one or more inactive container remnants from among the discovered container remnants, i.e., container remnants not being used by currently running containerized applications.

[0030] In certain embodiments, the computer memory scanner 210 first identifies inactive container remnants by distinguishing between container remnants used by currently running containerized applications and container remnants not used by currently running containerized applications. To distinguish between the two, the computer memory scanner 210 identifies persistently stored container remnants used by currently running containerized applications. Such active container remnants may contain several execution attributes, and furthermore, as the ongoing execution of the containerized application continues until completion, they will also be in the process of recording additional attributes.

[0031] In some embodiments, the computer memory scanner 210 identifies one or more active container remnants used by a currently running containerized application by identifying file handles to files within the container of the currently running containerized application. A file handle provides an index (e.g., a number) that the OS temporarily assigns to an open containerized file. The computer memory scanner 210 identifies one or more container remnants holding file handles as active container remnants used by the currently running containerized application, i.e., the container remnants corresponding to the file handles. In embodiments where the OS is Linux® or a Unix-like OS, the computer memory scanner 210 can use the Lsof ("list of files") command to determine the active container remnants used by the currently running containerized application based on the file handles.

[0032] In other embodiments, particularly in the context of a container orchestration system that manages containers using persistent volumes as well as ephemeral volumes, the computer memory scanner 210 identifies the active container remnant used by the currently running containerized application by identifying persistent volume claims that bind persistent volumes to a particular container. An example of code for generating persistent volume claims is: API Version: VL kind: PersistentVolumeClaim metadata: name: database-persistent-volume-claim spec: accessModes: --ReadWriteOnce recources: Request: Storage: 2Gi

[0033] Creating a persistent volume on the host machine and mounting it under a directory or folder within the container allows the container to have exclusive access to the persistent volume. Alternatively, a local directory on the host machine can be mounted as a persistent volume within the container, allowing data to be shared between the host machine and the container. Container mount point references found under or within a directory or folder in the container correspond to containerized applications that utilize persistent volumes bound to persistent volume claims. The computer memory scanner 210 can analyze executed container mount points to identify container remnants (persistent volumes) used by currently running containerized applications.

[0034] In this way, after identifying the active container remnants used by the currently running containerized application, the computer memory scanner 210 ignores all active container remnants and identifies the remaining container remnants as inactive container remnants not used by the currently running containerized application. Inactive container remnants do not explicitly identify, or otherwise respond to, the containerized application whose execution attributes were generated by the computer system through their execution, but the record of execution attributes provides clues about the identity of the containerized application whose execution has completed or otherwise terminated.

[0035] The PST120 container remnant classifier 220 classifies inactive container remnants identified by the computer memory scanner 210. Inactive container remnants are classified by the container remnant classifier 220 based on the system-generated execution attributes contained in each container remnant that has been identified as unused by the currently running containerized application.

[0036] A container remnant can contain various types of data that correspond to and provide records of execution attributes. These include, for example, log files, configuration files, directories, subdirectories, core dumps, diagnostic logs, startup logs, and backup files. Log files, for example, can provide records of events occurring in the operating system or other software during execution. Similarly, configuration files, for example, can provide records of program parameters and initial settings. Core dumps, for example, can provide records of the program's memory state at a specific instance, typically when the program crashes or terminates abnormally. Diagnostic logs can record data for diagnosing abnormal events or behaviors that occurred during execution. This content provides a collection of this data and various other execution attribute records when the execution of a containerized application is complete or terminated.

[0037] The container remnant classifier 220 performs pattern recognition to classify inactive container remnants. Inactive container remnants containing the same or similar patterns of execution attributes are assigned to the same category by the container remnant classifier 220. For example, inactive container remnants containing the same or similar log files and configuration files can be assigned to the same category corresponding to a single containerized application. Similarly, inactive container remnants containing the same or similar directory structure or subdirectories within a directory can be assigned to the same category. Different inactive container remnants may be created by the execution of different containers used jointly by a single complex containerized application. Based on pattern recognition, the container remnant classifier 220 places the same or similar container remnants into the same category, which is the category corresponding to a single, yet unspecified, containerized application. Based on pattern recognition, the categories to which container remnants are assigned by the container remnant classifier 220 can be defined as a superset of file types (e.g., log file entries, configuration entries) that match the same pattern, i.e., for example, sharing the same version string or having the same startup log entry, as described above. In certain embodiments, the pattern recognition performed by the container remnant classifier 220 is a statistical analysis that determines the probability or likelihood that the container remnants were generated by running the same containerized application.

[0038] In some embodiments, the container remnant classifier 220 uses statistical clustering to perform pattern recognition. Using a statistical clustering algorithm, the container remnant classifier 220 determines which inactive container remnants contain the same or statistically similar patterns of execution attributes. Clustering identifies sets of attributes common to different file types. For example, a cluster may define a set of unique application version strings in log files or configuration files corresponding to a containerized application. Based on statistical clustering, the container remnant classifier 220 assigns inactive container remnants containing the same or statistically similar patterns of execution attributes to the same category.

[0039] The containerized application identifier 230 compares the recognized execution attribute patterns for each category generated by the container remnant classifier 220 with data stored in the application fingerprint database 116. The execution attribute patterns contained in a container remnant function as a kind of fingerprint of the containerized application whose execution generated the container remnant, as described above. The data structure of the data stored in the application fingerprint database 116 functions as a catalog or index that maps given patterns to specific identities of containerized applications. In certain embodiments, for example, the data structure of the data stored in the application fingerprint database 116 includes file name, file extension, and optionally, file size. The containerized application identifier 230 thus refers to the application fingerprint database 116 to associate one or more inactive container remnants with the identity of a container application. Typically, if there is no perfect match between the execution attribute patterns contained in a container remnant and the execution attribute patterns of entries in the application fingerprint database 116, the containerized application identifier 230 can perform statistical analysis to determine (with a given level of confidence) whether there is a statistical correlation between the execution attributes contained in one or more inactive container remnants and one execution attribute in a data structure that maps execution attributes to the identity of the containerized application.

[0040] When the likelihood of an exact match is low, fuzzy matching techniques can be used according to specific embodiments. Fuzzy matching techniques enable database searches for entries that do not match the query but are similar, using the derivative of the query for approximate matching where the likelihood of correctly matching the query satisfies a predetermined threshold. For example, in some embodiments, a containerized application identifier 230 uses the Levenshtein distance algorithm to achieve fuzzy matching between a pattern of execution attributes contained in the container's remnant and a pattern of execution attributes of entries in the application fingerprint database 116. In some embodiments, an 80% threshold level may be used, but in other embodiments, different thresholds may be used by the containerized application identifier 230 in the application of the Levenshtein distance algorithm.

[0041] Optionally, in some embodiments, PST120 can generate an execution evidence list comprising the identity of each containerized application discovered and identified based on one or more container remnants and references to the application fingerprint database 116. Simultaneously with identification, PST120 can insert that identity into an execution evidence data structure. The data structure may include the containerized application name and the number of times the same containerized application has been discovered or the duration each time the containerized application was executed within a given time interval.

[0042] Figure 3 is a flowchart of Method 300 for identifying pre-executions of a containerized application according to an embodiment. Method 300 can be performed by the same or similar system as described with reference to Figures 1 and 2. The system may be a computer system operating in a computing environment that includes multiple compute nodes connected via a data communication network for provisioning a containerized application. In block 302, the system discovers a plurality of container remnants by electronically scanning a portion of the computer memory of at least one computer system of one or more compute nodes. The portion of computer memory may be allocated to persistent storage for computer data, and each container remnant may contain computer data that provides a record of system-generated execution attributes generated in response to the execution of one or more containerized applications. In block 304, the system identifies one or more inactive container remnants from the plurality of container remnants that are not being used by the currently running containerized application.

[0043] In block 306, the system classifies each inactive container remnant. The system classifies each inactive container remnant based on the system-generated execution attributes contained in each of the identified inactive container remnants. In block 308, based on the classification, the system identifies previously executed containerized applications by referring to a database containing data whose structure maps the identity of a containerized application to one or more patterns of execution attributes. In some embodiments, the data structure may consist of a file name and file extension mapped to the containerized application name. Optionally, in yet another embodiment, once a previously executed containerized application is identified by the system by referring to the database, the system may insert its identity into the execution evidence data structure.

[0044] Figure 4 is a flowchart of Method 400 for identifying inactive container remnants not used by a currently running containerized application, according to an embodiment. Method 400 can also be performed by the same or similar systems as described with reference to Figures 1 and 2. In block 402, the system identifies container remnants persistently stored in a portion of the computer memory of at least one computer system of one or more computing nodes. In a particular embodiment, the system identifies all such persistently stored container remnants. In block 404, the system classifies each persistently stored container remnant used by a currently running containerized application as an active container remnant. In block 406, the system ignores the persistently stored container remnants classified as active container remnants and classifies each of the remaining container remnants as an inactive container remnant (not used by a currently running application).

[0045] In certain embodiments, the system identifies container remnants used by a currently running containerized application by identifying persistently stored container remnants containing file handles. The system identifies file handles and searches for matches with file handles of the currently running containerized application. Based on the file handles, container remnants are classified as container remnants used by the currently running containerized application, with the currently running containerized application corresponding to the file handle. A file handle that does not match a file handle of the currently running containerized application indicates that the container remnant containing that file handle is an inactive container remnant.

[0046] In some embodiments, a persistently stored container remnant can constitute a persistent volume. The system can classify a persistent volume as a container remnant used by a currently running containerized application, based on a persistent volume claim. The persistent volume is classified as a container remnant used by a currently running containerized application, and the containerized application is bound to the persistent volume by the persistent volume claim.

[0047] Figure 5 is a flowchart of Method 500 for classifying container remnants identified as not being used by a currently running containerized application, according to an embodiment. Method 500 can also be performed by the same or similar systems described with reference to Figures 1 and 2. In block 502, the system performs pattern recognition on each container remnant identified as not being used by a currently running containerized application. In a particular embodiment, pattern recognition is performed using a statistical clustering algorithm on system-generated execution attributes contained in each container remnant identified as not being used by a currently running containerized application. In block 504, the statistical clustering-based system assigns container remnants containing the same or statistically similar execution attribute patterns to the same category.

[0048] While this disclosure includes a detailed description of cloud computing, it should be understood that implementations of the teachings described herein are not limited to cloud computing environments. Rather, embodiments of the present invention can be implemented in combination with any other type of computing environment that is currently known or may be developed in the future.

[0049] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with service providers. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0050] The characteristics are as follows:

[0051] On-demand self-service: Cloud consumers can unilaterally prepare computing power, such as server time and network storage, automatically as needed, without requiring human interaction with service providers.

[0052] Broad network access: Computing power is available over the network and accessible through standard mechanisms. This facilitates utilization by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, PDAs).

[0053] Resource pooling: A provider's computing resources are pooled and delivered to multiple consumers using a multi-tenant model. Various physical and virtual resources are dynamically allocated and reallocated as needed. Generally, consumers have a sense of location independence because they do not manage or know the exact location of the resources provided. However, consumers may be able to identify the location at a higher level of abstraction (e.g., country, state, data center).

[0054] Rapid Elasticity: Computing power can be prepared quickly and flexibly, allowing it to scale out automatically and immediately, and to be quickly released and scale in immediately. To consumers, the computing power available for preparation often appears unlimited and can be purchased in any quantity at any time.

[0055] Measured Services: Cloud systems leverage metric capabilities at a certain level of abstraction, appropriate for the type of service (e.g., storage, processing, bandwidth, active user accounts), to automatically control and optimize resource usage. Resource usage can be monitored, controlled, and reported, providing transparency to both service providers and consumers.

[0056] The service model is as follows:

[0057] Software as a Service (SaaS): The functionality offered to consumers is the ability to use the provider's applications running on a cloud infrastructure. These applications can be accessed from various client devices via thin client interfaces such as web browsers (e.g., webmail). Consumers do not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application functions, except for configuring a limited number of user-specific applications.

[0058] Platform as a Service (PaaS): The functionality offered to consumers is the ability to deploy applications they have created or acquired to cloud infrastructure using programming languages ​​and tools supported by the provider. Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, and storage, but they can control the deployed applications and, in some cases, the configuration of their hosting environment.

[0059] Infrastructure as a Service (IaaS): The functionality provided to consumers is the provision of processors, storage, networking, and other basic computing resources that enable consumers to deploy and run any software, including operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but they can control the operating system, storage, and deployed applications, and in some cases, partially control certain network components (e.g., host firewalls).

[0060] The deployment model is as follows:

[0061] Private Cloud: This cloud infrastructure is operated exclusively for a specific organization. This cloud infrastructure can be managed by that organization or a third party and can reside on-premises or off-premises.

[0062] Community Cloud: This cloud infrastructure is shared by multiple organizations to support a specific community with common interests (e.g., mission, security requirements, policies, and compliance). This cloud infrastructure can be managed by the organization or a third party and can reside on-premises or off-premises.

[0063] Public Cloud: This cloud infrastructure is provided to a large number of people or large industry groups and is owned by organizations that sell cloud services.

[0064] Hybrid Cloud: This cloud infrastructure combines two or more cloud models (private, community, or public). While maintaining the unique entities of each model, they are bound together by standards or individual technologies to achieve data and application portability (e.g., cloud bursting for load balancing across clouds).

[0065] Cloud computing environments are service-oriented environments that emphasize statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is the infrastructure, which includes a network of interconnected nodes.

[0066] Here, Figure 6 shows an exemplary cloud computing environment 600. As shown in the figure, the cloud computing environment 600 includes one or more cloud computing nodes 610. Local computer devices used by cloud consumers (e.g., PDAs or mobile phones 640A, desktop computers 640B, laptop computers 640C, or automotive computer systems 640N, or a combination thereof) can communicate with these nodes. Nodes 2010 can communicate with each other. Nodes 610 can be grouped physically or virtually (not shown) in one or more networks, such as the private, community, public, or hybrid clouds or a combination thereof. This allows the cloud computing environment 600 to provide infrastructure, platforms, or software as a service, or a combination thereof, without requiring cloud consumers to maintain resources on their local computer devices. Note that the types of computer devices 640A-N shown in Figure 6 are merely examples, and it should be understood that computing nodes 610 and the cloud computing environment 600 can communicate with any type of electronic device via any type of network or network addressable connection (e.g., using a web browser) or both.

[0067] Here, Figure 7 shows the set of functional abstraction layers provided by the cloud computing environment 600 (Figure 6). It should be understood that the components, layers, and functions shown in Figure 7 are merely illustrative, and the embodiments of the present invention are not limited to these. As illustrated, the following layers and corresponding functions are provided.

[0068] The hardware and software layer 760 includes hardware components and software components. Examples of hardware components include a mainframe 761, a reduced instruction set computer (RISC) architecture-based server 762, a server 763, a blade server 764, storage devices 765, and a network and network components 766. In some embodiments, the software components include network application server software 767 and database software 768.

[0069] The virtualization layer 770 provides an abstraction layer. From this layer, for example, the following virtual entities can be provided: virtual servers 771, virtual storage 772, virtual networks 773 including virtual private networks, virtual applications and operating systems 774, and virtual clients 775.

[0070] As an example, the management layer 780 can provide the following functions: Resource preparation 781 enables the dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and pricing 782 enables cost tracking as resources are used within the cloud computing environment and billing or invoicing for the consumption of these resources. As an example, these resources may include licenses for application software. Security enables not only protection of data and other resources, but also identification and verification of cloud consumers and tasks. User portal 783 provides consumers and system administrators with access to the cloud computing environment. Service level management 784 enables the allocation and management of cloud computing resources to ensure that requested service levels are met. Service Level Agreement (SLA) planning and execution 785 enables the pre-arrangement and procurement of cloud computing resources that are expected to be needed in the future in accordance with the SLA.

[0071] Workload layer 790 provides examples of the capabilities available to cloud computing environments. Examples of workloads and capabilities available from this layer include mapping and navigation 791, software development and lifecycle management 792, virtual classroom education delivery 793, data analytics processing 794, transaction processing 795, and PST 796.

[0072] Figure 8 is a schematic diagram of an example of a computing node 800. In one or more embodiments, the computing node 800 is an example of a suitable cloud computing node. The computing node 800 is not intended to imply any limitations on the scope of use or functionality of the embodiments of the present invention described herein. The computing node 800 can perform any of the functions described in this disclosure.

[0073] Computing node 800 includes computer system 812, which can operate in a number of other general-purpose or specialized computing system environments or configurations. Examples of well-known computing systems, environments, or configurations or combinations thereof that may be suitable for use with computer system 812 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices.

[0074] Computer system 812 is sometimes described in the general context of computer systems executing computer system executable instructions, such as program modules. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc., that perform a specific task or implement a specific abstract data type. Computer system 812 may be implemented in a distributed cloud computing environment where tasks are executed by remote processing units linked over a communication network. In a distributed cloud computing environment, program modules may reside on both local and remote computer system storage media, including memory storage devices.

[0075] As shown in Figure 8, the computer system 812 is shown in the form of a general-purpose computing device. The components of the computer system 812 may include, but are not limited to, one or more processors 816, memory 828, and a bus 818 that connects various system components, including memory 828, to the processor 816. As defined herein, “processor” means at least one hardware circuit configured to execute instructions. The hardware circuit may be an integrated circuit. Examples of processors include, but are not limited to, central processing units (CPUs), array processors, vector processors, digital signal processors (DSPs), field-programmable gate arrays (FPGAs), programmable logic arrays (PLAs), application-specific integrated circuits (ASICs), programmable logic circuits, and controllers.

[0076] The execution of instructions in a computer program by a processor consists of program execution or running. As defined herein, “run” and “execute” consist of a series of actions or events performed by a processor in accordance with one or more machine-readable instructions. As defined herein, “running” and “executing” mean the active performance of actions or events by a processor. In this specification, the terms run, running, execute, and executing are used synonymously.

[0077] Bus 818 represents one or more of several types of bus structures, including memory buses or memory controllers, peripheral buses, accelerated graphics ports, and processor or local buses using one of various bus architectures. Examples, but not limited to, such architectures include the Industry Standard Architecture (ISA) bus, Microchannel Architecture (MCA) bus, Extended ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, Peripheral Component Interconnect (PCI) bus, and PCI Express (PCIe) bus.

[0078] The computer system 812 typically includes various computer system-readable media. Such media may be any available media accessible by the computer system 812 and may include both volatile and non-volatile media, and removable and non-removable media.

[0079] Memory 828 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 830 or cache memory 832 or both. Computer system 812 may further include other removable / non-removable, volatile / non-volatile computer system storage media. For example, storage system 834 may be provided for reading from and writing to a non-removable, non-volatile magnetic medium or a solid-state drive or a combination thereof (not shown, commonly referred to as a “hard drive”). Not shown, a magnetic disk drive for reading from and writing to a removable, non-volatile magnetic disk (e.g., a “floppy disk”) and an optical disk drive for reading from and writing to a removable, non-volatile optical disk, such as a CD-ROM, DVD-ROM, or other optical medium may be provided. In such cases, each may be connected to bus 818 by one or more data medium interfaces. As further described and explained below, memory 828 may include at least one program product having a set of program modules (e.g., at least one) configured to perform the functions of embodiments of the present invention.

[0080] A program / utility 840 having a set (at least one) of program modules 842 may be stored in memory 828, as well as, for example, but not limited to, an operating system, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data, or any combination thereof, may include an implementation of a networking environment. The program modules 842 generally implement the functions or methodologies, or both, of the embodiments of the present invention described herein. For example, one or more program modules may include PST796 or a part thereof.

[0081] The program / utility 840 is executable by the processor 816. Any data items used, generated, or manipulated, or a combination thereof, by the program / utility 840 and the computer system 812 are functional data structures that impart functionality when employed by the computer system 812. As defined herein, “data structure” is a physical implementation of the organization of a data model of data in physical memory. Thus, a data structure is formed of specific electrical or magnetic structural elements in memory. A data structure imparts physical organization to data stored in memory so that it may be used by application programs executed using the processor.

[0082] Computer system 812 may also communicate with one or more external devices 814, such as a keyboard, pointing device, and display 824; one or more devices that enable a user to interact with computer system 812; or any device (e.g., a network card, modem, etc.) or a combination thereof that enables computer system 812 to communicate with one or more other computer devices. Such communication may occur via the input / output (I / O) interface 822. Computer system 812 may also communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), or a public network (e.g., the Internet) or a combination thereof, via the network adapter 820. As depicted, the network adapter 820 communicates with other components of computer system 812 via the bus 818. It should be understood that other hardware or software components or combinations thereof, not shown in the illustration, may be used with computer system 812. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archive storage systems.

[0083] While computing node 800 is used to illustrate an example of a cloud computing node, it should be understood that computer systems using the same or similar architecture as those described in relation to Figure 8 may be used in non-cloud computing implementations to perform the various operations described herein. In this regard, the exemplary embodiments described herein are not intended to be limited to cloud computing environments. Computing node 800 is an example of a data processing system. As defined herein, “data processing system” means one or more hardware systems configured to process data, each hardware system including at least one processor programmed to start operation and memory.

[0084] Computing node 800 is an example of computer hardware. Computing node 800 may include fewer components than those shown or additional components not shown in Figure 8, depending on the specific type of device or system or both that are implemented. The specific operating system or application or both that are included may vary depending on the type of device or system or both, as well as the type of I / O device that is included. Furthermore, one or more of the illustrated components may be incorporated into another component or form part of another component. For example, a processor may include at least some memory.

[0085] Computing node 800 is also an example of a server. As defined herein, “server” means a data processing system configured to share services with one or more other data processing systems. As defined herein, “client device” means a data processing system with which a user directly interacts to request shared services from a server. Examples of client devices include, but are not limited to, workstations, desktop computers, computer terminals, mobile computers, laptop computers, netbook computers, tablet computers, smartphones, personal digital assistants, smartwatches, smart glasses, gaming devices, set-top boxes, and smart televisions. In one or more embodiments, various user devices described herein may be client devices. Network infrastructure such as routers, firewalls, switches, and access points are not client devices as defined herein by the term “client device”.

[0086] The terms used herein are for the purpose of describing specific embodiments and are not intended to limit them. Nevertheless, some definitions applicable throughout this document are now presented.

[0087] In this specification, the singular forms "a," "an," and "the" are defined to include the plural form unless the context clearly indicates otherwise.

[0088] In this specification, “another” means at least two or more.

[0089] As defined herein, “at least one,” “one or more,” and “and / or,” are open-ended expressions that are conjugate and separate in operation unless expressly otherwise stated. For example, each of the expressions “at least one of A, B, and C,” “at least one of A, B, or C,” “one or more of A, B, and C,” “one or more of A, B, or C,” and “A, B, or C or a combination thereof” means A alone, B alone, C alone, together with A and B, together with A and C, together with B and C, or together with A, B, and C.

[0090] In this book, "automatic" means without user intervention.

[0091] As defined herein, “includes,” “including,” “comprises,” or “comprising,” or any combination thereof, specifies the existence of the described features, integers, steps, actions, elements, or components, but does not exclude the existence or addition of one or more other features, integers, steps, actions, elements, components, or groups thereof or combinations thereof.

[0092] As defined herein, “if” means, depending on the context, “in response to” or “responsive to.” Therefore, the expression “if it is determined” may be interpreted, depending on the context, as “in response to determining” or “responsive to determining.” Similarly, the expression “if [a stated condition or event] is detected” may be interpreted, depending on the context, as “upon detecting [the stated condition or event]” or “in response to detecting [the stated condition or event]” or “responsive to detecting [the stated condition or event].”

[0093] As defined herein, “one embodiment,” “embodiment,” “one or more embodiments,” “in a particular embodiment,” or similar language means that a particular feature, structure, or characteristic described in relation to an embodiment is included in at least one embodiment described in this disclosure. Therefore, all occurrences of the aforementioned words or similar language or combinations thereof throughout this disclosure may, but are not necessarily, refer to the same embodiment.

[0094] As defined herein, "output" means, for example, storage to a physical memory element such as a device, writing to a display or other peripheral output device, transmission or transfer to another system, export, etc.

[0095] As defined herein, the expressions “in response to” and “responsive to” mean readily responding to or reacting to an action or event. Therefore, when a second action is performed “in response to” or “responsive to” a first action, there is a causal relationship between the occurrence of the first action and the occurrence of the second action. The expressions “in response to” and “responsive to” indicate a causal relationship.

[0096] The term “substantially” means that the mentioned characteristic, parameter, or value does not need to be exactly achieved, and deviations or variations, including tolerances, observation errors, limits of measurement accuracy, and other factors known to those skilled in the art, may occur to an extent that does not hinder the intended effect of that characteristic.

[0097] In this specification, terms such as "First," "Second," etc., may be used to describe various elements. These terms are used solely to distinguish one element from another, and should not be limited by these elements, unless otherwise specified or clearly indicated by the context.

[0098] The present invention may be a system, method, or computer program product or combination thereof, integrated at any possible level of technical detail. The computer program product may include a computer-readable storage medium storing computer-readable program instructions for causing a processor to perform aspects of the present invention.

[0099] A computer-readable storage medium can be a tangible device capable of holding and storing instructions used by an instruction execution device. Examples of computer-readable storage media may be electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or appropriate combinations thereof. More specific examples of computer-readable storage media include portable computer diskettes, hard disks, RAM, ROM, EPROM (or flash memory), SRAM, CD-ROM, DVD, memory stick, floppy disk, punch cards, or grooved raised structures, and mechanically encoded devices on which instructions are recorded, and appropriate combinations thereof. Computer-readable storage devices as used herein should not be interpreted as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses passing through optical fiber cables), or electrical signals transmitted through wires.

[0100] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computer device / processor. Alternatively, they can be downloaded to an external computer or external storage device via a network (e.g., the Internet, LAN, WAN, or wireless network, or a combination thereof). The network may include copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers or edge servers, or a combination thereof. A network adapter card or network interface within each computer device / processor receives computer-readable program instructions from the network and transfers them for storage in a computer-readable storage medium in the respective computer device / processor.

[0101] The computer-readable program instructions for performing the operation of the present invention may be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuits, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk and C++, and procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer-readable program instructions can be executed as a standalone software package, either entirely on the user's computer or partially on the user's computer. Alternatively, they can be executed partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network, including LANs and WANs, or it may be connected to an external computer (for example, via the Internet using an Internet service provider). In some embodiments, electronic circuits, including, for example, programmable logic circuits, field-programmable gate arrays (FPGAs), and programmable logic arrays (PLAs), can execute computer-readable program instructions by utilizing state information of computer-readable program instructions in order to customize the electronic circuits for the purpose of performing aspects of the present invention.

[0102] Embodiments of the present invention are described herein with reference to flowcharts or block diagrams, or both, of methods, apparatus (systems), and computer program products according to embodiments of the present invention. Each block in a flowchart or block diagram, or both, and combinations of blocks in a flowchart or block diagram, or both, are executable by computer-readable program instructions.

[0103] The above computer-readable program instructions may be provided to a computer or other programmable data processing device processor for the purpose of producing a machine. This creates means for these instructions, executed via such computer or other programmable data processing device processor, to perform functions / operations identified in one or more blocks in a flowchart or block diagram, or both. The above computer-readable program instructions may further be stored in a computer-readable storage medium that can be instructed to function in a particular manner to a computer, programmable data processing device, or other device, or a combination thereof. This constitutes a product in which the computer-readable storage medium storing the instructions includes instructions for performing functions / operations identified in one or more blocks in a flowchart or block diagram, or both.

[0104] Alternatively, a computer execution process may be generated by loading computer-readable program instructions into a computer, another programmable device, or other device, and having a series of operational steps executed on that computer, other programmable device, or other device. This ensures that the instructions executed on the computer, other programmable device, or other device perform functions / operations identified in one or more blocks in a flowchart, block diagram, or both.

[0105] The flowcharts and block diagrams in the drawings of this disclosure illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, containing one or more executable instructions for performing a particular logical function. In some other implementations, the functions shown within a block may be executed in an order different from the order shown in each figure. For example, two consecutively shown blocks may actually be achieved as a single process, executed simultaneously or substantially simultaneously, executed in a partially or entirely overlapping manner in time, or, in some cases, executed in reverse order, depending on the functions involved. Each block in a block diagram or flowchart or both, and combinations of multiple blocks in a block diagram or flowchart or both, are executable by a dedicated hardware-based system that performs a particular function or operation, or executes a combination of dedicated hardware and computer instructions.

[0106] The descriptions of various embodiments of the present invention are presented for illustrative purposes only and are not intended to exhaust or limit the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terms used herein have been selected to best describe the principles of the embodiments, the practical application or technical improvement to the art available on the market, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

1. Discovering a plurality of container remnants by electronically scanning a portion of the computer memory of at least one computer system of one or more computing nodes, wherein the portion of computer memory is allocated to a persistent storage device for computer data, and each container remnant includes computer data that provides a record of execution attributes generated in response to the execution of one or more containerized applications. From among the aforementioned multiple container remnants, identify one or more inactive container remnants that are not being used by the currently running application, Classifying each inactive container remnant, the classification being based on the execution attributes contained in each container remnant identified as an inactive container remnant, Based on the above classification, this includes identifying previously executed containerized applications by referring to a database containing data on a structure for identifying containerized applications corresponding to patterns of execution attributes, Identifying the one or more inactive container remnants is Identifying a container remnant permanently stored in the computer memory portion of at least one computer system of the one or more computing nodes, Classify each identified container remnant used by the currently running containerized application as an active container remnant, This includes classifying each remaining container remnant as an inactive container remnant, The structure of the aforementioned data includes a file name and file extension that map to the containerized application name, Computer implementation method.

2. Classifying each of the aforementioned inactive container remnants is Using a statistical clustering algorithm, perform pattern recognition on the execution attributes contained in each inactive container remnant, The method according to claim 1, comprising assigning each inactive container remnant having the same or statistically similar pattern of execution attributes to the same category.

3. It is a computer system, and the computer system is Discovering a plurality of container remnants by electronically scanning a portion of the computer memory of at least one computer system of one or more computing nodes, wherein the portion of computer memory is allocated to a persistent storage device for computer data, and each container remnant includes computer data that provides a record of execution attributes generated in response to the execution of one or more containerized applications. From among the aforementioned multiple container remnants, identify one or more inactive container remnants that are not being used by the currently running application, Classifying each inactive container remnant, the classification being based on the execution attributes contained in each container remnant identified as an inactive container remnant, A processor configured to initiate an operation that includes identifying previously executed containerized applications by referring to a database containing data of a structure for identifying containerized applications corresponding to patterns of execution attributes based on the aforementioned classification, Identifying the one or more inactive container remnants is Identifying a container remnant permanently stored in the computer memory portion of at least one computer system of the one or more computing nodes, Classify each identified container remnant used by the currently running containerized application as an active container remnant, This includes classifying each remaining container remnant as an inactive container remnant, The structure of the aforementioned data is a computer system that includes a file name and file extension that map to a containerized application name.

4. Classifying each of the aforementioned inactive container remnants is Using a statistical clustering algorithm, perform pattern recognition on the execution attributes contained in each inactive container remnant, The system according to claim 3, comprising assigning each inactive container remnant containing the same or statistically similar patterns of execution attributes to the same category.

5. It is a computer program, and the computer program is used by a computer. Discovering a plurality of container remnants by electronically scanning a portion of the computer memory of at least one computer system of one or more computing nodes, wherein the portion of computer memory is allocated to a persistent storage device for computer data, and each container remnant includes computer data that provides a record of execution attributes generated in response to the execution of one or more containerized applications. From among the aforementioned multiple container remnants, identify one or more inactive container remnants that are not being used by the currently running application, Classifying each inactive container remnant, the classification being based on the execution attributes contained in each container remnant identified as an inactive container remnant, Based on the above classification, the system initiates an operation that includes identifying previously executed containerized applications by referring to a database containing data on a structure for identifying containerized applications corresponding to execution attribute patterns, Identifying the one or more inactive container remnants is Identifying a container remnant permanently stored in the computer memory portion of at least one computer system of the one or more computing nodes, Classify each identified container remnant used by the currently running containerized application as an active container remnant, This includes classifying each remaining container remnant as an inactive container remnant, The structure of the data is a computer program that includes a file name and file extension that map to a containerized application name.

6. Classifying each of the aforementioned inactive container remnants is Using a statistical clustering algorithm, perform pattern recognition on the execution attributes contained in each inactive container remnant, The computer program according to claim 5, comprising assigning each inactive container remnant having the same or statistically similar pattern of execution attributes to the same category.

Images