# US 11,029,975 B2 · Automated container image assembly > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,029,975 B2 - Document ID: US11029975B2 - Status: Granted - Kind: B2 - Application number: 16/590,611 - Filed: 2019-10-02 - Published: 2021-04-08 - Granted: 2021-06-08 - Earliest claimed: 2019-10-02 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Sanjay Kumar Prasad; Divakar R. Mysore; Srinivas G. Kulkarni; Balakrishnan Sreenivasan; Ashutosh Kumar - Web page: https://patentgrep.com/patent/US11029975B2 ## CPC - G06F 9/44526: {Plug-ins; Add-ons} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 2009/45562: {Creating, deleting, cloning virtual machine instances} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2221/033: Test or assess software - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Automatically generating a container image assembly file is provided. A definition of an application is assessed to determine a base container image and application libraries needed as add-ons for a container image corresponding to the application. A library dependency graph of flow from the base container image to add-on libraries for the application is generated. The container image assembly file is generated based on the library dependency graph of flow from the base container image to the add-on libraries for the application. Vulnerabilities corresponding to the add-on libraries of the container image assembly file are removed. ## Claims ### Claim 1 A computer-implemented method for automatically generating a container image assembly file, the computer-implemented method comprising: assessing, by a computer, a definition of an application to determine a base container image and application libraries needed as add-ons for a container image corresponding to the application; generating, by the computer, a library dependency graph of flow from the base container image to add-on libraries for the application; generating, by the computer, the container image assembly file based on the library dependency graph of flow from the base container image to the add-on libraries for the application; removing, by the computer, vulnerabilities corresponding to the add-on libraries of the container image assembly file; ingesting, by the computer, historical container image assembly file data corresponding to the application; building, by the computer, a knowledge base of historical library dependency data based on ingested historical container image assembly file data corresponding to the application and received user feedback corresponding to container image assembly file optimization to automatically generate the container image assembly file; and curating, by the computer, the historical library dependency data in the knowledge base. ### Claim 2 (depends on 1) The computer-implemented method of claim 1 further comprising: optimizing, by the computer, the container image assembly file that was generated based on the library dependency graph of flow from the base container image to the add-on libraries for the application by providing alternate paths for installation of the add-on libraries with the vulnerabilities removed. ### Claim 3 (depends on 1) The computer-implemented method of claim 1 further comprising: optimizing, by the computer, the container image assembly file that was generated based on the library dependency graph of flow from the base container image to the add-on libraries for the application by merging multiple sequential layers of the container image assembly file based on predefined rules for reducing a number of layers in the container image assembly file, wherein the predefined rules are selected from a group consisting of file affinity in sequential layers according to information in a knowledge base, size of a layer after merging layers not exceeding a predefined layer size, and user-defined rules. ### Claim 4 (depends on 1) The computer-implemented method of claim 1 further comprising: generating, by the computer, a container image for the application using the container image assembly file that was generated based on the library dependency graph of flow from the base container image to the add-on libraries for the application. ### Claim 5 (depends on 4) The computer-implemented method of claim 4 further comprising: deploying, by the computer, the container image to a set of host nodes in a production environment for running. ### Claim 6 (depends on 1) The computer-implemented method of claim 1 further comprising: generating, by the computer, a vector for each respective add-on library with frequency of direct-follows relationships with every other add-on library vector. ### Claim 7 (depends on 1) The computer-implemented method of claim 1 further comprising: generating, by the computer, the library dependency graph with bindings on splits and joins of the add-on libraries for each broad combination of the base container image, wherein each path in the library dependency graph is a valid sequence of library dependencies. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the library dependency graph identifies most common libraries for a given base container image and a probability that these libraries are needed by the given base container image, precedent libraries, dependent libraries, most common sequence of library dependencies for a given set of libraries, libraries contained within a given layer of the given base container image, and frequency of change or rebuild of each given library. ### Claim 9 A computer system for automatically generating a container image assembly file, the computer system comprising: a bus system; a storage device connected to the bus system, wherein the storage device stores program instructions; and a processor connected to the bus system, wherein the processor executes the program instructions to: assess a definition of an application to determine a base container image and application libraries needed as add-ons for a container image corresponding to the application; generate a library dependency graph of flow from the base container image to add-on libraries for the application; generate the container image assembly file based on the library dependency graph of flow from the base container image to the add-on libraries for the application; remove vulnerabilities corresponding to the add-on libraries of the container image assembly file; ingest historical container image assembly file data corresponding to the application; build a knowledge base of historical library dependency data based on ingested historical container image assembly file data corresponding to the application and received user feedback corresponding to container image assembly file optimization to automatically generate the container image assembly file; and curate the historical library dependency data in the knowledge base. ### Claim 10 (depends on 9) The computer system of claim 9, wherein the processor further executes the program instructions to: optimize the container image assembly file that was generated based on the library dependency graph of flow from the base container image to the add-on libraries for the application by providing alternate paths for installation of the add-on libraries with the vulnerabilities removed. ### Claim 11 (depends on 9) The computer system of claim 9, wherein the processor further executes the program instructions to: optimize the container image assembly file that was generated based on the library dependency graph of flow from the base container image to the add-on libraries for the application by merging multiple sequential layers of the container image assembly file based on predefined rules for reducing a number of layers in the container image assembly file, wherein the predefined rules are selected from a group consisting of file affinity in sequential layers according to information in a knowledge base, size of a layer after merging layers not exceeding a predefined layer size, and user-defined rules. ### Claim 12 (depends on 9) The computer system of claim 9, wherein the processor further executes the program instructions to: generate a container image for the application using the container image assembly file that was generated based on the library dependency graph of flow from the base container image to the add-on libraries for the application. ### Claim 13 A computer program product for automatically generating a container image assembly file, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising: assessing, by the computer, a definition of an application to determine a base container image and application libraries needed as add-ons for a container image corresponding to the application; generating, by the computer, a library dependency graph of flow from the base container image to add-on libraries for the application; generating, by the computer, the container image assembly file based on the library dependency graph of flow from the base container image to the add-on libraries for the application; removing, by the computer, vulnerabilities corresponding to the add-on libraries of the container image assembly file; ingesting, by the computer, historical container image assembly file data corresponding to the application; building, by the computer, a knowledge base of historical library dependency data based on ingested historical container image assembly file data corresponding to the application and received user feedback corresponding to container image assembly file optimization to automatically generate the container image assembly file; and curating, by the computer, the historical library dependency data in the knowledge base. ### Claim 14 (depends on 13) The computer program product of claim 13 further comprising: optimizing, by the computer, the container image assembly file that was generated based on the library dependency graph of flow from the base container image to the add-on libraries for the application by providing alternate paths for installation of the add-on libraries with the vulnerabilities removed. ### Claim 15 (depends on 13) The computer program product of claim 13 further comprising: optimizing, by the computer, the container image assembly file that was generated based on the library dependency graph of flow from the base container image to the add-on libraries for the application by merging multiple sequential layers of the container image assembly file based on predefined rules for reducing a number of layers in the container image assembly file, wherein the predefined rules are selected from a group consisting of file affinity in sequential layers according to information in a knowledge base, size of a layer after merging layers not exceeding a predefined layer size, and user-defined rules. ### Claim 16 (depends on 13) The computer program product of claim 13 further comprising: generating, by the computer, a container image for the application using the container image assembly file that was generated based on the library dependency graph of flow from the base container image to the add-on libraries for the application. ### Claim 17 (depends on 16) The computer program product of claim 16 further comprising: deploying, by the computer, the container image to a set of host nodes in a production environment for running.