International Business Machines Corporation

Peng Xa Cui

Yu Zhang

Liang Wang

Tan Jiang

Dong Hui

Chun Xiao Zhang

Da Hu Kuang

Xu Peng

Lan Ling

Dong Hai Yu

Guang Ya Liu

Jin Chi Jc He

Hou Gang Liu

Yu Xing Yx Ren

An approach to managing images in a registry constructed as a multi-layer file system are disclosed. The method comprises receiving a first request for downloading a first image, the first request comprising a download policy. The method also comprises obtaining a plurality of compositions of layers of the first image, wherein content of layers specified by each composition of layers collectively constitute content of the first image. The method also comprises selecting a composition of layers from the plurality of compositions of layers of the first image based on the download policy. The method also comprises sending content of layers specified by the selected composition of layers.

Registry image management

A method and system. A dataset is generated according to a code package. The code package includes an image file associated with a container for a tenant in a cloud environment. The dataset includes general information related to security aspects of the image file. The image file includes two or more image layers. A security indicator of the image file is extracted according to the dataset. A security level of the image file is determined by comparing the extracted security indicator of the image file with a security indicator of an authenticated image file. A vulnerability in the image file is identified based on the determined security level. In response to the vulnerability having been identified, the image file is updated with a patch that fixes the identified vulnerability. The patch includes a new image layer added to the two or more image layers in the updated image file.

Code package processing

A method and system for code package. A dataset is generated according to a code package. The code package includes an image file associated with a container for a tenant. The dataset includes general information related to security aspects of the image file. The image file includes two or more image layers. Generating the dataset according to the code package includes: exporting an image layer from the image file; and obtaining a configuration file of the exported image layer as the dataset. In response to the vulnerability having been identified, the image file is updated with a patch that fixes the identified vulnerability. The patch includes a new image layer added to the two or more image layers in the updated image file.

A method and associated system. A dataset is generated according to a code package. The code package includes an image file associated with a container for a tenant in a cloud environment. The dataset includes general information related to security aspects of the image file. A security level of the image file is determined according to the generated dataset. A vulnerability corresponding to the code package is identified based on the security level. In response to the vulnerability having been identified, the code package is updated with a patch associated with the identified vulnerability.

Growing community of inventors

Xi'an, China

Peng Xa Cui