US 11,892,418 B1Granted

Container image inspection and optimization

AssigneeAmazon Technologies, Inc.

InventorsMalcolm Featonby, Sravan Rengarajan

Life of this patent

Estimating the term…

Loading patent…

Abstract

Provided is a system for inspecting and optimizing containerized software applications. A container image may include a plurality of files and layers, and some of such files and layers may not be used during the execution of the container image. A system described herein can identify and remove such unused files and/or layers from the container image by launching an inspector task configured to launch the container image, monitor access to the files in the container image, identify which files are unused, and remove the unused files from the container image (or generate a new container image not including the unused files). By doing so, the system can reduce the size of the container image, which can reduce the storage costs, startup latency, and security vulnerabilities associated with the container image.

Claims20

Dependent claims

A cloud provider system comprising:

a set of clusters hosted on a plurality of physical machines, wherein each cluster in the set of clusters includes a virtual machine configured to perform tasks;
a container registry service providing a plurality of image repositories, wherein each image repository of the plurality of image repositories is configured to at least store a plurality of container images including a plurality of container image layers and executable on the virtual machines of the set of clusters;
and
a container service comprising computer hardware, wherein the container service is configured to access the plurality of container images from the container registry service,
wherein the container service is further configured to at least:
receive a request to optimize a first container image, wherein the request indicates a first set of parameters usable to execute the first container image, and wherein the first container image contains a plurality of container image layers that each contain a plurality of files usable during the execution of the first container image;
determine a second set of parameters usable to execute an inspector container image, wherein the inspector container image is configured to monitor access to the plurality of files in the plurality of container image layers of the first container image during the execution of the first container image, and wherein the second set of parameters identifies at least the first container image;
cause the inspector container image to be executed using the second set of parameters;
based at least in part on the execution of the inspector container image, identify a subset of unused files of the plurality of files in at least one container image layer of the plurality of container image layers of the first container image and a subset of used files of the plurality of files in the first container image;
and
output a report indicating at least the subset of unused files of the plurality of files in the at least one container image layer of the plurality of container image layers of the first container image.

8 more elements

A non-transitory computer-readable medium storing instructions that, when executed by a computing system within a cloud provider network, cause the computing system to perform operations comprising:

receiving a request to inspect a first container image, wherein the request indicates a first set of parameters usable to execute the first container image, and wherein the first container image contains a plurality of files usable during the execution of the first container image;
determining a second set of parameters usable to execute an inspector container image, wherein the inspector container image is configured to monitor access to the plurality of files in the first container image during the execution of the first container image;
executing the inspector container image using the second set of parameters;
identifying (i) at least one unused file of the plurality of files in the first container image that was unused during the execution of the inspector container image, and (ii) a subset of remaining files of the plurality of files in the first container image that were used during the execution of the inspector container image;
and
outputting an indication of the at least one unused file of the plurality of files in the first container image.

3 more elements

Dependencies are inferred from the claim text.