International Business Machines Corporation

Xu Peng

Yu Zhang

Liang Wang

Tan Jiang

Dong Hui

Da Hu Kuang

Chun Xiao Zhang

Peng Xa Cui

Lan Ling

A method and system. A dataset is generated according to a code package. The code package includes an image file associated with a container for a tenant in a cloud environment. The dataset includes general information related to security aspects of the image file. The image file includes two or more image layers. A security indicator of the image file is extracted according to the dataset. A security level of the image file is determined by comparing the extracted security indicator of the image file with a security indicator of an authenticated image file. A vulnerability in the image file is identified based on the determined security level. In response to the vulnerability having been identified, the image file is updated with a patch that fixes the identified vulnerability. The patch includes a new image layer added to the two or more image layers in the updated image file.

Code package processing

A method and system for code package. A dataset is generated according to a code package. The code package includes an image file associated with a container for a tenant. The dataset includes general information related to security aspects of the image file. The image file includes two or more image layers. Generating the dataset according to the code package includes: exporting an image layer from the image file; and obtaining a configuration file of the exported image layer as the dataset. In response to the vulnerability having been identified, the image file is updated with a patch that fixes the identified vulnerability. The patch includes a new image layer added to the two or more image layers in the updated image file.

A method and associated system. A dataset is generated according to a code package. The code package includes an image file associated with a container for a tenant in a cloud environment. The dataset includes general information related to security aspects of the image file. A security level of the image file is determined according to the generated dataset. A vulnerability corresponding to the code package is identified based on the security level. In response to the vulnerability having been identified, the code package is updated with a patch associated with the identified vulnerability.

Growing community of inventors

Shenyang, China

Xu Peng