Container Dependency Manifests for Accurate Vulnerability Scanning

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current security scanners are unable to determine the dependencies of a container accurately due to appended package files being detached from the container image, leading to incomplete vulnerability assessments.

Innovation Solution

Generate and store a manifest file within the container that lists its dependencies, allowing security scanners to identify vulnerabilities by referencing this file, even if the appended package file is removed.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If security scanners rely on appended package files to determine container dependencies, then the scanning process is simple, but the accuracy of vulnerability identification deteriorates when package files are detached

Engineering Contradiction:

Improvescanning process simplicityVSAvoidvulnerability identification accuracy

Core Design Contradiction:

Ease of operationVSMeasurement precision

Solution Approach 1:

The patent segments the dependency information into two parts: the appended package file (for simple scanning) and the embedded manifest file within the container image (for accurate dependency identification). This segmentation allows the system to maintain both scanning simplicity and identification accuracy by using the manifest file as a reliable backup when package files are detached.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The manifest file acts as an intermediary between the container image and the security scanner. It provides a reliable, embedded source of dependency information that the scanner can use directly, eliminating the need to solely rely on external appended package files and ensuring accurate vulnerability identification regardless of package file attachment status.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Loss of substance

If appended package files are detached from container images, then storage efficiency improves, but the ability to accurately determine dependencies deteriorates

Engineering Contradiction:

Improvestorage efficiencyVSAvoiddependency information availability

Core Design Contradiction:

Loss of substanceVSLoss of information

Solution Approach 1:

The patent embeds the manifest file containing dependency information directly within the container image structure. This nesting ensures that the dependency information is permanently stored inside the container, making it accessible even when external appended package files are detached, thus preventing information loss while maintaining storage efficiency.

Inventive Principle:

Principle #7Nested doll (Nesting)

Solution Approach 2:

The manifest file is generated and embedded within the container image during the container creation process, before the container is deployed or scanned. This preliminary action ensures that dependency information is already available in the correct format and location, eliminating the need for post-creation attachment of package files and ensuring information availability regardless of subsequent storage optimizations.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12579280B2Systems and methods for vulnerability scanning of dependencies in containers

Publication Date: 2026.03.17 GOOGLE LLC

AI summary

A method includes identifying, by a processing device, a set of parameters to generate a container image for a container. The parameters comprise one or more dependencies associated with running the container in a cloud-based environment. A manifest file referencing the one or more dependencies is obtained and the container image is generated based on the set of parameters, wherein the manifest file is stored in a predetermined location associated with the container.