Universal Container Base Image Rehydration for OS Updates

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In container-based processing environments, updating the operating system (OS) layer of application-specific container images to address vulnerabilities is time-consuming and resource-intensive, especially for entities managing numerous applications.

Innovation Solution

Implementing a system that rehydrates a universal container base image, separating the OS layer and application-specific code, allowing for updates to the OS layer without requiring updates to individual application-specific container images.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If application-specific container images are updated to address OS vulnerabilities, then security is improved, but time consumption and resource usage increase

Engineering Contradiction:

ImprovesecurityVSAvoidtime consumption

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent segments container images into a universal base image (containing OS layer) and application-specific layers. This allows the OS layer to be updated independently in the base image without requiring updates to all application-specific images, thus improving security while reducing time consumption.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The universal container base image serves multiple applications simultaneously. By maintaining a single updated base image, the system can provide security updates to numerous applications at once, improving security efficiency and reducing overall update time and resource consumption.

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Reliability

If application-specific container images are updated to address OS vulnerabilities, then security is improved, but computational resources increase

Engineering Contradiction:

ImprovesecurityVSAvoidcomputational resources

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

By separating the OS layer into a universal base image, the system reduces the number of images that need to be processed during updates. Only the base image requires regeneration and distribution, significantly reducing computational resources compared to updating all application-specific images individually.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The universal base image serves as a shared foundation for multiple applications. Updating it once provides security improvements across all applications simultaneously, reducing the total computational resources required compared to individual updates for each application image.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Ease of operation

If a universal container base image is used for multiple applications, then ease of management is improved, but device complexity increases

Engineering Contradiction:

Improveease of managementVSAvoidsystem complexity

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

The system architecture is segmented into a universal base image layer and application-specific layers. This segmentation simplifies management by allowing updates to the base image that automatically propagate to all applications, while maintaining the ability to customize individual applications without affecting the shared base layer.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements a nested structure where application-specific container images are built upon the universal base image. This nesting allows the base image to contain common OS components while application layers provide specific functionality, creating a manageable hierarchy that reduces overall system complexity despite the universality of the base image.

Inventive Principle:

Principle #7Nested doll (Nesting)

Data Source

PatentUS20250130818A1Scalable and dynamic process for rehydrating universal container base images

Publication Date: 2025.04.24 CAPITAL ONE SERVICES LLC

AI summary

In some implementations, a container processing device may receive a universal container base image, the universal container base image including a first set of instructions associated with an operating system associated with multiple applications. The container processing device may create a container based on the first set of instructions included in the universal container base image. The container processing device may receive an application-specific code separate from the universal container base image, the application-specific code including a second set of instructions associated with an application, of the multiple applications. The container processing device may inject the second set of instructions into the container during a runtime of the container. The container processing device may execute the application based on at least the first set of instructions included in the container and the second set of instructions included in the container.