Container Image Vulnerability Reduction via Runtime File Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Container images often include unnecessary files that expose vulnerabilities and increase size, making them heavier and more prone to security issues.
Innovation Solution
A system that monitors the execution of applications within containers to identify necessary files, rebuilds a new container image excluding unnecessary files, and updates symbolic links to maintain functionality while reducing vulnerabilities and size.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If container images include all necessary files for application execution, then application functionality is maintained, but vulnerabilities and image size increase
Solution Approach 1:
The patent extracts and removes unnecessary files from container images while retaining only those files required for application execution. This is achieved by monitoring file access patterns during application runtime and identifying which files are actually needed, then creating a minimized container image that excludes superfluous files that could introduce vulnerabilities.
Solution Approach 2:
The patent segments the container image into essential and non-essential components by analyzing file access patterns. By dividing the file system into necessary and unnecessary portions, the system can selectively include only the required segments in the final container image, reducing the attack surface while maintaining functionality.
2Reliability
If container images include all necessary files for application execution, then application functionality is maintained, but image size increases
Solution Approach 1:
The patent extracts and removes unnecessary files from container images while retaining only those files required for application execution. This is achieved by monitoring file access patterns during application runtime and identifying which files are actually needed, then creating a minimized container image that excludes superfluous files that could introduce vulnerabilities.
Solution Approach 2:
The patent applies partial action by including only the subset of files that are necessary for application execution, rather than including all files. The file monitoring mechanism identifies the minimal required set of files, and the container image is constructed with only this partial set, optimizing size while maintaining functionality.
3Object-affected harmful factors
If container images are minimized to reduce vulnerabilities, then security is improved, but application execution may be compromised
Solution Approach 1:
The patent performs preliminary file access monitoring during application execution to identify which files are necessary before finalizing the minimized container image. This preliminary action ensures that all required files are identified and included in the reduced image, preventing execution failures while achieving security hardening.
Solution Approach 2:
The patent uses feedback from file monitoring mechanisms to dynamically determine which files are essential for application execution. The system continuously monitors file access patterns and uses this feedback information to accurately identify necessary files, ensuring that the minimized container image includes all required components for successful application execution.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for container image vulnerability reduction. In one aspect, a method includes obtaining a first container image that is formed from a set of files, determining that a first particular file of the set of files is necessary for an application and a second particular file of the set of files is not necessary for the application based on execution of the application in a first container instantiated with the first container image, in response generating a second container image from the first particular file and not from the second particular file, and executing the application in a second container instantiated with the second container image.