Temporal Layers for Container Image Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software containers pose a security risk by exposing sensitive information when images are published to a registry, as this information can be accessed by downstream users.
Innovation Solution
A new syntax in the container build language is introduced to define layers as temporal, ensuring they exist only during the build process and are automatically deleted before the image is published, thereby excluding sensitive information from the final image stored in the registry.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If all build commands including sensitive information are included in the image layers, then the image contains complete build information, but sensitive information becomes accessible to downstream users
Solution Approach 1:
The patent segments the image build process into multiple layers, distinguishing between persistent layers (containing stable, reusable files) and temporal layers (containing sensitive, build-specific information). This segmentation allows sensitive information to be isolated in temporal layers that are deleted after the build process, preventing exposure in the final image while maintaining complete build information during construction.
Solution Approach 2:
The patent performs preliminary classification of build commands into temporal and persistent categories before image creation. By identifying which layers should be temporal (containing sensitive information like API keys, passwords, or temporary configuration) before the build process begins, the system can automatically manage their lifecycle - creating them during build, using them as needed, then deleting them before the image is finalized and published.
2Reliability
If temporal layers are deleted from the image, then sensitive information is protected, but the build process complexity increases
Solution Approach 1:
The patent implements self-service automation where the build system automatically identifies temporal layers, manages their creation and deletion, and handles the complexity of layer lifecycle management without requiring manual intervention. The system serves itself by automatically classifying commands, creating temporal layers when needed, and deleting them when no longer required, reducing the perceived complexity for users while maintaining security.
Solution Approach 2:
The patent changes the state parameter of image layers from static to dynamic by introducing temporal layers with automatic lifecycle management. Layers transition from being created during build to being automatically deleted after use, changing their existence parameter over time. This parameter change enables automatic security protection without requiring complex manual processes.
3Quantity of substance
If unnecessary layers are included in the image, then all build information is preserved, but image size increases and resource requirements increase
Solution Approach 1:
The patent applies the principle of discarding temporal layers after their useful purpose is fulfilled during the build process. Temporal layers containing sensitive or temporary information are created when needed, used for their specific build purpose, then discarded (deleted) before the image is finalized. This discarding process reduces image size and resource requirements while preserving essential build information in persistent layers.
Data Source
AI summary
Systems and methods for building images used in software containers are disclosed. A computer-implemented method includes: receiving, at a host computer, plural commands defined in a build file; determining, by the host computer, one of the plural commands is indicated as a temporal layer; building, by the host computer, an image including respective layers corresponding to respective ones of the plural commands; deleting from the image, by the host computer, one of the respective layers corresponding to the one of the plural commands indicated as the temporal layer; and pushing, by the host computer, the image to a registry.