Managing updates to container images

• US 10,324,708 B2
• Filed: 11/14/2017
• Issued: 06/18/2019
• Est. Priority Date: 11/14/2017
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Griffin, Leigh, Coady, Stephen
• Primary Examiner(s): Rampuria, Satish
• Application Number:
  US15/812,026
• Publication Number:
  US 20190146772A1
• Time in Patent Office: 581 Days
• Field of Search: 717120-135, 717168-178
• CPC Class Codes: G06F 11/0766 Error or fault reporting or storing
• CPC Class Codes: G06F 11/3664 Environments for testing or debugging software
• CPC Class Codes: G06F 11/3688 for test execution, e.g. scheduling of test suites
• CPC Class Codes: G06F 8/63 Image based installation; Cloning; Build to order
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines

Abstract

Updates to container images can be managed. For example, a processing device can detect that a first container-image is updated by monitoring a repository associated with the first container-image. The first container-image can be updated subsequent to a second container-image being built. The processing device can determine that the second container-image depends on the first container-image by analyzing a database that indicates a dependency relationship between the second container-image and the first container-image. The processing device can then automatically rebuild the second container-image using an updated version of the first container-image in response to (i) detecting that the first container-image was updated, and (ii) determining that the second container-image depends on the first container-image.

Claims

1. A method comprising:

receiving, by a processing device, an alert for a piece of software;

in response to receiving the alert, determining, by the processing device, that a first container-image comprises the piece of software;

in response to determining that the first container-image comprises the piece of software, monitoring, by the processing device, a repository configured to store one or more versions of the first container-image for an updated version of the first container-image;

while monitoring the repository, detecting, by the processing device, the updated version of the first container-image, wherein the first container-image is updated subsequent to a second container-image being built;

determining, by the processing device, that the second container-image depends on the first container-image by analyzing a database that indicates a dependency relationship between the second container-image and the first container-image; and

in response to (i) detecting the updated version of the first container-image and (ii) determining that the second container-image depends on the first container-image, automatically rebuilding, by the processing device, the second container-image using the updated version of the first container-image to create an updated version of the second container-image.

2. The method of claim 1, further comprising, prior to monitoring the repository for the updated version of the first container-image:

receiving the alert for the piece of software by accessing a database of alerts;

in response to receiving the alert, determining that the alert meets one or more predefined criteria in a customizable rule set by analyzing the alert;

based on determining that the alert meets the one or more predefined criteria, determining that the piece of software is to be updated;

and

based on determining that (i) the piece of software is to be updated and (ii) the first container-image includes the piece of software, flagging the first container-image for monitoring.

3. The method of claim 2, wherein the one or more predefined criteria comprises at least one of (i) the piece of software being a predefined piece of software;

(ii) a product related to the piece of software being a predefined product;

(iii) a severity level of the alert being a predefined severity-level;

(iv) a date related to the alert being a predefined date;

or (v) a programming language related to the piece of software being a predefined programming language.

4. The method of claim 2, further comprising:

based on flagging the first container-image for monitoring, monitoring the repository to detect when the first container-image is updated; and

detecting that the first container-image was updated based on the updated version of the first container-image being stored in the repository.

5. The method of claim 1, further comprising determining that the second container-image depends on the first container-image by:

analyzing a plurality of container images to determine one or more container dependencies for each respective container-image of the plurality of container images;

storing a respective relationship between each respective container-image and the one or more container dependencies in the database; and

determining that there is a correspondence between the second container-image and the first container-image in the database.

6. The method of claim 1, further comprising:

determining that multiple container images depend on the first container-image using the database; and

rebuilding the multiple container images in response to (i) detecting that the first container-image was updated and (ii) determining that the multiple container images depend on the first container-image.

7. The method of claim 1, further comprising:

in response to detecting that the updated version of the second container-image is created, provisioning a test environment that has one or more characteristics defined by a customizable rule-set;

running one or more tests in the test environment on the updated version of the second container-image to ensure that the updated version of the second container-image complies with one or more predefined requirements, the one or more tests being defined by the customizable rule-set;

determining that the updated version of the second container-image passed the one or more tests; and

based on determining that the updated version of the second container-image passed the one or more tests, shutting down the test environment.

8. A system comprising:

a processing device; and

a memory device that includes instructions executable by the processing device for causing the processing device to;

receive an alert for a piece of software;

in response to receiving the alert, determine that a first container-image comprises the piece of software;

in response to determining that the first container-image comprises the piece of software, monitor a repository configured to store one or more versions of the first container-image for an updated version of the first container-image;

while monitoring the repository, detect the updated version of the first container-image, wherein the first container-image is updated subsequent to a second container-image being built;

determine that the second container-image depends on the first container-image by analyzing a database that indicates a dependency relationship between the second container-image and the first container-image; and

in response to (i) detecting the updated version of the first container-image and (ii) determining that the second container-image depends on the first container-image, automatically rebuild the second container-image using the updated version of the first container-image to create an updated version of the second container-image.

9. The system of claim 8, wherein the memory device further includes instructions that are executable by the processing device for causing the processing device to, prior to monitoring the repository for the updated version of the first container-image:

receive the alert for the piece of software by accessing a database of alerts;

in response to receiving the alert, determine that the alert meets one or more predefined criteria in a customizable rule set by analyzing the alert;

based on determining that the alert meets the one or more predefined criteria, determine that the piece of software is to be updated;

and

based on determining that (i) the piece of software is to be updated and (ii) the first container-image includes the piece of software, flag the first container-image for monitoring.

10. The system of claim 9, wherein the one or more predefined criteria comprises at least one of (i) the piece of software being a predefined piece of software;

(ii) a product related to the piece of software being a predefined product;

(iii) a severity level of the alert being a predefined severity-level;

(iv) a date related to the alert being a predefined date;

or (v) a programming language related to the piece of software being a predefined programming language.

11. The system of claim 9, wherein the memory device further includes instructions that are executable by the processing device for causing the processing device to:

based on flagging the first container-image for monitoring, monitor the repository to detect when the first container-image is updated; and

detect that the first container-image was updated based on the updated version of the first container-image being stored in the repository.

12. The system of claim 8, wherein the memory device further includes instructions that are executable by the processing device for causing the processing device to determine that the second container-image depends on the first container-image by:

analyzing a plurality of container images to determine one or more container dependencies for each respective container-image of the plurality of container images;

storing a respective relationship between each respective container-image and the one or more container dependencies in the database; and

determining that there is a correspondence between the second container-image and the first container-image in the database.

13. The system of claim 8, wherein the memory device further includes instructions that are executable by the processing device for causing the processing device to:

determine that multiple container images depend on the first container-image using the database; and

rebuild the multiple container images in response to (i) detecting that the first container-image was updated and (ii) determining that the multiple container images depend on the first container-image.

14. The system of claim 8, wherein the memory device further includes instructions that are executable by the processing device for causing the processing device to:

in response to detecting that the updated version of the second container-image is created, provision a test environment that has one or more characteristics defined by a customizable rule-set;

run one or more tests in the test environment on the updated version of the second container-image to ensure that the updated version of the second container-image complies with one or more predefined requirements, the one or more tests being defined by the customizable rule-set;

determine that the updated version of the second container-image passed the one or more tests; and

based on determining that the updated version of the second container-image passed the one or more tests, shut down the test environment.

15. A non-transitory computer-readable medium comprising instructions executable by a processing device for causing the processing device to:

receive an alert for a piece of software;

in response to receiving the alert, determine that a first container-image comprises the piece of software;

in response to determining that the first container-image comprises the piece of software, monitor a repository configured to store one or more versions of the first container-image for an updated version of the first container-image;

while monitoring the repository, detect the updated version of the first container-image, wherein the first container-image is updated subsequent to a second container-image being built;

determine that the second container-image depends on the first container-image by analyzing a database that indicates a dependency relationship between the second container-image and the first container-image; and

in response to (i) detecting the updated version of the first container-image and (ii) determining that the second container-image depends on the first container-image, automatically rebuild the second container-image using the updated version of the first container-image to create an updated version of the second container-image.

16. The non-transitory computer-readable medium of claim 15, further comprising instructions that are executable by the processing device for causing the processing device to, prior to monitoring the repository for the updated version of the first container-image:

receive the alert for the piece of software by accessing a database of alerts;

in response to receiving the alert, determine that the alert meets one or more predefined criteria in a customizable rule set by analyzing the alert;

based on determining that the alert meets the one or more predefined criteria, determine that the piece of software is to be updated;

and

based on determining that (i) the piece of software is to be updated and (ii) the first container-image includes the piece of software, flag the first container-image for monitoring.

17. The non-transitory computer-readable medium of claim 16, wherein the one or more predefined criteria comprises at least one of (i) the piece of software being a predefined piece of software;

(ii) a product related to the piece of software being a predefined product;

(iii) a severity level of the alert being a predefined severity-level;

(iv) a date related to the alert being a predefined date;

or (v) a programming language related to the piece of software being a predefined programming language.

18. The non-transitory computer-readable medium of claim 16, further comprising instructions that are executable by the processing device for causing the processing device to:

based on flagging the first container-image for monitoring, monitor the repository to detect when the first container-image is updated; and

detect that the first container-image was updated based on the updated version of the first container-image being stored in the repository.

19. The non-transitory computer-readable medium of claim 15, further comprising instructions that are executable by the processing device for causing the processing device to determine that the second container-image depends on the first container-image by:

analyzing a plurality of container images to determine one or more container dependencies for each respective container-image of the plurality of container images;

storing a respective relationship between each respective container-image and the one or more container dependencies in the database; and

determining that there is a correspondence between the second container-image and the first container-image in the database.

20. The non-transitory computer-readable medium of claim 15, further comprising instructions that are executable by the processing device for causing the processing device to:

determine that multiple container images depend on the first container-image using the database; and

rebuild the multiple container images in response to (i) detecting that the first container-image was updated and (ii) determining that the multiple container images depend on the first container-image.