Red Hat, Inc.

Joel Smith

Thomas Wiest

A method of container and image scanning includes receiving, by a processing device initiating a scan process to scan containers executing functionality of multiple applications. The method further includes, for each container of the containers, identifying portions of an application image instance of the container, the portions corresponding to previously-scanned clean layers of the application image instance, scanning, by the processing device in accordance with the scan process, remaining portions of the application image instance not associated with the previously-scanned clean layers, and responsive to a clean result of the scanning of the remaining portions of the application image instance, terminating, by the processing device, the scan process for the container and allowing the container having the application image instance to execute.

Container and image scanning for a platform-as-a-service system

A method of container and image scanning includes receiving, by a processing device executing a node of a multi-tenant Platform-as-a-Service (PaaS) system, a pluggable scan process to scan containers of the multi-tenant PaaS system to detect patterns indicative of threats to the multi-tenant PaaS system, installing, by the processing device, the pluggable scan process at the node, scanning, by the processing device via the pluggable scan process at the node, a top layer of an application image instance used to launch a container at the node without scanning remaining layers of the application image instance, and in response to the scanning generating a clean result, terminating, by the processing device, the pluggable scan process for the container.

A method of container and image scanning includes storing at a central scan store of a multi-tenant system, an image scan result for a container image, the container image for executing functionality of applications and comprising layers, wherein the image scan result generated by a scan process comprising scanning a top layer of the container image, the remaining layers of the container image are immutable, verifying a clean status of the remaining layers of the container image with the central scan store, and transmitting the image scan result for the container image, the image scan result being clean in response to a clean result returned for the scanning and successful verification of the clean status of the remaining layers. The method further includes responsive to receiving a container image scan result request for the container image, transmitting the image scan result for the container image.

Implementations provide for container and image scanning for a Platform-as-a-Service (PaaS) system. A method of the disclosure includes initiating, by a processing device executing a node of a multi-tenant Platform-as-a-Service (PaaS) system, a scan process at the node to scan containers executing on the node, the containers executing functionality of multiple applications that are owned by multiple owners. The method further includes, for each container of the containers, scanning, by the processing device in accordance with the scan process, a top layer of application image instance used to launch the container in the node without scanning remaining layers of the application image instance, and terminating, by the processing device, the scan process for the container when the scanning generates a clean result.

Growing community of inventors

Orem, UT, United States of America

Joel Smith