Container Image Genealogy with Metadata-Based Vulnerability Attribution

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Determining responsible developers or teams for software vulnerabilities in complex container images is difficult, complicating remediation efforts.

Innovation Solution

A method involving adding user metadata to container images, scanning for vulnerabilities, and generating mappings between metadata and vulnerabilities to assign remediation actions to responsible users or groups.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If multiple developers and teams contribute to a container image over time, then the container image becomes more functional and complex, but it becomes difficult to determine which developer or team is responsible for vulnerable software

Engineering Contradiction:

Improvecontainer image functionalityVSAvoidvulnerability responsibility identification

Core Design Contradiction:

Adaptability or versatilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent segments the container image into distinct software components, each tagged with metadata identifying the specific developer or team that contributed it. This segmentation allows the system to track responsibility for each software component independently, resolving the difficulty of identifying vulnerability sources in complex, multi-contributor container images.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces metadata as an intermediary element that bridges the relationship between software components and their creators. This metadata acts as a traceable link, enabling the system to automatically identify which developer or team is responsible for each software component without requiring direct human investigation.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If comprehensive scanning is performed to identify all software vulnerabilities, then security detection capability is improved, but the time and resources required for remediation increase

Engineering Contradiction:

Improvesecurity vulnerability detectionVSAvoidremediation time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent implements a feedback mechanism where vulnerability scan results are immediately correlated with metadata information to automatically generate remediation task assignments. This feedback loop enables rapid response by directly linking detected vulnerabilities to responsible developers or teams, significantly reducing remediation time while maintaining comprehensive security scanning.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent performs preliminary actions by pre-tagging all software components with metadata during the container image building process, before vulnerabilities are introduced. This preliminary organization of responsibility information enables rapid vulnerability attribution and remediation assignment when security scanning is performed, reducing the time required for the remediation process.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20250220037A1Container image genealogy in a computing system

Publication Date: 2025.07.03 SYSDIG INC

AI summary

An example method of managing a container image in a computing system includes: adding, by first software executing on a host, metadata associated with a user to the container image, the metadata related to a set of software in the container image; receiving, by the first software or second software, the container image; scanning, by the first software or the second software, the container image to identify a software vulnerability; generating, by the first software or the second software, a mapping between the metadata and the software vulnerability; and assigning a remediation action to remediate the container image based on the mapping.