Red Hat, Inc.

Brian Gallagher

Cathal O'Connor

Michael Gerard Ryan

A shim layer can be incorporated into a container image for intercepting calls between an upper layer and a lower layer of the container image according to some aspects described herein. For example, a system can build an image file that includes a stacked arrangement of layers configured for deploying a software program within a container. The stacked arrangement of layers can include a lower layer including one or more objects. The stacked arrangement of layers can include an upper layer positioned above the lower layer, where the upper layer includes the software program. And the stacked arrangement of layers can include a shim layer positioned between the lower layer and the upper layer. The shim layer can include a shim, which is configured to intercept calls involving the one or more objects from the software program and responsively allow or reject the calls based on control data.

Shim layer for intercepting calls between an upper layer and a lower layer of a container image

Systems and methods of the disclosure include: identifying, by a cloud resource management system, a cloud resource consumption model associated with one or more cloud resources; generating, by the cloud resource management system, a sequence of instructions implementing a smart contract based on the cloud resource consumption model; sending, to a distributed ledger network, the smart contract; receiving, by the cloud resource management system, cloud resource usage data associated with the one or more cloud resources; and causing, by transmitting a message reflecting the cloud resource usage data to the distributed ledger, the smart contract to be executed.

Managing cloud resource consumption using distributed ledgers

Systems and methods for implementing an annotation driven just in time and state-based RBAC policy control are disclosed. The method inserts an annotation into a code base that includes a function. The annotation identifies a resource corresponding to the function. The method compiles the code base into compiled code, which includes inserting, based on the annotation, a first request prior to the function that requests permission to access the resource; and inserting, based on the annotation, a second request subsequent to the function to turn off permission to access the resource. The method then deploys the compiled code to a target environment.

Annotation driven just in time and state-based RBAC policy control

The sizes of image files for deploying software in a computing environment can be reduced according to some examples described herein. In one example, a system can identify base image files that each include at least a predefined amount of dependencies relied upon by target software. The system can then select a particular base image file, from the base image files, having a smallest size as compared to a remainder of the base image files. The system can then build a customized image file from the base image file, where the customized image file is configured for deploying the target software to a computing environment.

Reducing the size of image files usable for deploying software in computing environments

Systems and methods comprising at least one node comprising an application container; a container image associated with the application container; a static analyzer module deployed to analyze the container image, with instructions configured to autonomously parse, code of an application, during compile time of the application, wherein the application is to be deployed in the application container; determine, based on the parsing, for at least one section of the code, at least one module necessary for execution of the at least one section; annotate, the at least one section of the code, based on the determined at least one module; and inject, at least one wrapper around the at least one section of the code, wherein the wrapper adds at least one restriction to an execution of the at least one section at runtime, wherein the restrictions are based on at least one condition.

Shim based secure module access

Disclosed are systems and methods for scanning a client codebase for vulnerabilities without exposing the client information. An example method includes receiving, from a client computing device, a scan request to scan a set of encrypted client information to identify vulnerabilities applicable to the client information. The method also includes responsive to the scan request, analyzing, by a processing device, the encrypted client information to generate scan results that identify vulnerabilities applicable to the client information, wherein the analyzing is performed without decrypting the client information. The method also includes returning the scan results to the client, wherein the scan results are in encrypted form when the scan results are generated.

Privacy-enhanced common vulnerabilities and exposures (CVE) detection

Systems and methods of the disclosure include: receiving, by a node of a distributed ledger network, first transaction data, wherein the first transaction data comprises an alert derived from a state of a computer system; storing the first transaction data in a first block of the distributed ledger network; receiving, by the node, second transaction data, wherein the second transaction data comprises an identifier of a remedial action performed on the computer system in response to the alert and a result of performing the remedial action; and storing the second transaction data in a block of the distributed ledger network, wherein the block is provided by one of: the first block or a second block.

Managing standard operating procedures using distributed ledger networks

Processing logic may obtain a resource of a platform fora containerized application. The platform may include custom resources, and an operator that manages the custom resources during runtime of the containerized application. In response to an indication being defined in the resource, processing logic may schedule an upgrade to a new operator. Processing logic may perform one or more pre-installation actions or post-installation actions that are defined in the resource to manage the installation of the new operator in a controlled manner and reduce the risk of incompatibilities between the new operator and the custom resources.

Enhancing operator installation and upgrade management and verification

Excessive polling that may result in wasted computing resources and unnecessary network traffic can be avoided using some techniques described herein. In one example, a method can include obtaining historical data indicating execution times associated with computing operations. The method can also include determining polling times to assign to the computing operations by applying a model to the historical data. The method may also include configuring a software application to implement the polling times in relation to polling processes for transmitting requests to execute the computing operations to one or more destinations.

Configuring polling times for software applications

Task permissions for software services can be set in a distributed computing environment according to some examples described herein. In one example, a system can determine software services that are included in software products deployable to a user account of a distributed computing environment. The system can determine task permissions to be set in the user account for allowing the software services to execute tasks in the distributed computing environment. The system can generate a list of task permissions by consolidating the task permissions based on predefined rules. The system can then transmit an output indicating the list of task permissions for causing the user account to be configured based on the list of task permissions, to permit the software services to execute the tasks in the distributed computing environment.

Setting task permissions for software services in distributed computing environments

Systems and methods of the disclosure include: receiving, by a cloud resource provisioning component via a cloud provisioning request application programming interface (API), a cloud resource request; storing the cloud resource request on a cryptographically-protected distributed ledger; receiving, from a first cloud provider, a first cloud resource offer responsive to the cloud resource request; and responsive to receiving, from a node of the cryptographically-protected distributed ledger, a notification of validation of the first cloud resource offer with respect to the cloud resource request, causing the first cloud provider to provision a cloud resource specified by the first cloud resource offer.

Growing community of inventors

Waterford, Ireland

Brian Gallagher