Container Registry Layer Segmentation for Storage Efficiency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software container technologies lack effective revision control, efficient storage resource management, and adequate security vulnerability scanning, leading to potential security risks and inefficiencies in managing and deploying containerized software images.
Innovation Solution
A container registry system that allows for the storage, management, and deployment of container images as layers, with features such as garbage collection, security sweeps, and predictive caching, along with token-based authentication and automated build and deployment services, to enhance revision control, storage efficiency, and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If container images are stored as complete files, then storage is simple, but storage resources are wasted due to redundant data across multiple images
Solution Approach 1:
The patent segments container images into hierarchical layers (read-only base layers and read-write runtime layers). Each layer is stored independently and can be shared across multiple container images. This segmentation allows the registry to store only the unique portions of images, eliminating redundancy while maintaining simple storage operations through the layer abstraction.
Solution Approach 2:
The patent implements garbage collection mechanisms that automatically identify and remove unused or obsolete container image layers from storage. When layers are no longer referenced by any active container images, they are discarded to free storage resources. This recovering process maintains storage efficiency without requiring manual intervention.
2Ease of manufacture
If traditional file-based storage is used for container images, then implementation is straightforward, but revision control and security scanning are limited
Solution Approach 1:
By segmenting images into layered components with unique identifiers, the system enables granular revision control. Each layer can be independently versioned, tracked, and scanned for security vulnerabilities. This segmentation allows comprehensive security scanning of individual layers without requiring complete image reconstruction, improving both reliability and implementation efficiency.
Solution Approach 2:
The patent introduces intermediary services including security scanning agents and revision control mechanisms that operate on the layered structure. These intermediaries provide enhanced security verification and version management capabilities while maintaining compatibility with standard container image formats, thus improving reliability without sacrificing implementation simplicity.
3Reliability
If security scanning is performed on complete container images, then comprehensive security checks are achieved, but scanning efficiency and speed are reduced
Solution Approach 1:
The layered architecture enables security scanners to process individual layers independently rather than analyzing complete container images. Scanning can be performed on specific layers as needed, allowing comprehensive security coverage of critical components while significantly improving efficiency by avoiding redundant scanning of shared read-only layers that are already verified.
Solution Approach 2:
Security scanning is performed preliminarily on base layers during the image building process. Once a base layer is scanned and verified, the security results are cached and reused for all container images that inherit from that layer. This preliminary action ensures comprehensive security coverage while dramatically improving scanning efficiency for subsequent images.
4Quantity of substance
If all container image layers are stored in the registry, then complete images are available, but storage resource utilization is inefficient
Solution Approach 1:
The registry stores container images as segmented layers rather than complete monolithic files. Only the necessary layers required to reconstruct specific images are stored and retrieved. This segmentation allows the system to maintain image completeness for deployment while optimizing storage utilization by storing only unique layer data once and sharing it across multiple images.
Solution Approach 2:
Each stored layer serves multiple functions and can be reused by numerous different container images. A single base layer may be shared across hundreds of images, making the storage system universally applicable. This multi-functionality of layers dramatically improves storage utilization while ensuring that complete images can be reconstructed when needed for deployment.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A request to store, in first data store associated with a customer of a computing resource service provider, a software image is received, the request including a set of layers of the software image to be stored. As a result of successful authentication of the request, based at least in part on a security token included with the request, a subset of layers of the software image that have not previously been stored in the first data store are determined, based at least in part on first metadata obtained from a second data store, the subset of layers in the first data store are stored, second metadata about the subset of layers are stored in the second data store, and the software image is caused to be launched in a software container of an instance based at least in part on the subset of layers.