Container Registry Service Layered Storage and Security Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software container systems lack effective revision control, efficient storage resource utilization, and adequate security vulnerability scanning, leading to potential security risks and inefficiencies in managing and deploying containerized software images.
Innovation Solution
A container registry service that stores container images as layers, enables efficient storage, provides revision control, and includes tools for security vulnerability scanning and licensing compliance, allowing for automated deployment and garbage collection of unused layers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If container images are stored as complete files, then storage is simple, but storage resources are wasted due to redundant data across multiple images
Solution Approach 1:
The container image storage system is segmented into multiple layers, where each layer represents a distinct set of file system changes. This allows independent storage and management of each layer, enabling efficient deduplication and incremental updates without requiring complete image replication.
Solution Approach 2:
Container images are structured as nested layers, where each layer contains only the differences from the previous layer. This nesting approach allows the system to store only incremental changes, significantly reducing total storage requirements while maintaining the ability to reconstruct complete images when needed.
2Reliability
If all container image versions are retained for revision control, then version history is complete, but storage consumption increases
Solution Approach 1:
The system implements automated garbage collection that identifies and removes unreferenced layer data while maintaining the ability to recover previous versions through layer reconstruction. This allows complete revision control where any historical version can be rebuilt from its constituent layers, yet storage is optimized by eliminating redundant and unreferenced data.
3Reliability
If security scanning is performed on all container images, then security coverage is comprehensive, but processing time increases
Solution Approach 1:
Security scanning is segmented to operate at the layer level rather than requiring complete image reconstruction and scanning. This allows the scanning process to work directly on individual layers in their native format, significantly reducing processing time while maintaining comprehensive security coverage across all image components.
4Ease of operation
If container images are stored in distributed locations, then accessibility is improved, but data consistency and management complexity increase
Solution Approach 1:
The layer-based storage format provides universal compatibility across distributed storage locations and different container runtime environments. Each layer is stored as a self-contained, standardized unit that can be independently managed, retrieved, and assembled at any location, simplifying distributed storage management while maintaining data consistency through the standardized layer interface.
Data Source
AI summary
A request to store a container image is received from a device associated with a customer of a computing resource service provider. Validity of a security token associated with the request is authenticated using a cryptographic key maintained as a secret by the computing resource service provider. One or more layers of the container image is built based at least in part on at least one build artifact to form a set of built layers. The software image including the set of built layers is stored in a repository associated with the customer. A manifest of metadata for the set of built layers is stored in a database of a structured data store. The container image is obtained in the form of an obtained container image. The obtained container image is deployed as the software container in at least one virtual machine instance associated with the customer.