Embedding-Based Container Image Compliance Matching

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing container import systems in cloud computing environments face compliance issues due to varying organizational policies, as containers developed for different environments may include unsupported features or require root access, making them non-compliant with target environments.

Innovation Solution

A method that extracts embeddings from non-compliant container images and compares them to a catalog of compliant images, identifying similar images to deploy a compliant version by modifying layers and adhering to target environment policies, using a neural network to generate and compare embeddings for file structures, hash values, and build commands.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If containers are developed for different computing environments, then portability and versatility are improved, but compliance with target environment policies deteriorates

Engineering Contradiction:

Improvecontainer portabilityVSAvoidcompliance with target environment

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system creates a compliant copy of the non-compliant container image by extracting embeddings and identifying similar images from a catalog. Instead of directly deploying the non-compliant image, the system generates a modified compliant version that preserves the essential functionality while adhering to target environment policies

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The system modifies container image parameters by comparing embeddings of non-compliant images against compliant images in the catalog. The system identifies differences in layer embeddings and applies parameter changes to transform the non-compliant image into a compliant one, adjusting features such as root access permissions, unsupported features, and policy violations

Inventive Principle:

Principle #35Parameter changes

2Reliability

If container images are manually reviewed and modified for compliance, then compliance accuracy is improved, but processing time and operational complexity increase

Engineering Contradiction:

Improvecompliance accuracyVSAvoidimage processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system replaces manual compliance review with an automated embedding-based comparison mechanism. Neural networks extract embeddings from container images and automatically compare them against a catalog of compliant images, eliminating the need for manual policy checking while maintaining high compliance accuracy

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system enables self-service compliance checking by automatically extracting embeddings, comparing them against the catalog, and identifying compliant alternatives without requiring human intervention. The process is autonomous and can be performed at scale

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS11954474B2Generating compliant container images via embeddings

Publication Date: 2024.04.09 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

A method, computer systems and program product to import non-compliant container images is provided. A processor receives a non-compliant container image, wherein the container image is not compliant with a target computing environment. A processor extracts a one or more embeddings from the non-compliant container image. A processor compares the one or more embeddings from the non-compliant container image to a plurality of one or more embeddings from an image catalog. A processor identifies a similar image from the image catalog based on the comparison of layer embeddings from the non-compliant container image and the similar image. A processor deploys the similar image in the target computing environment.