# US 12,112,155 B2 · Software application container hosting > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,112,155 B2 - Document ID: US12112155B2 - Status: Granted - Kind: B2 - Application number: 17/324,335 - Filed: 2021-05-19 - Published: 2022-11-24 - Granted: 2024-10-08 - Earliest claimed: 2021-05-19 - Assignees: Kyndryl, Inc. - Applicants: Kyndryl, Inc. - Inventors: Igor Monteiro Vieira; Marcelo Mota Manhaes; Thiago Bianchi; Suellen Caroline Da Silva - Web page: https://patentgrep.com/patent/US12112155B2 ## CPC - G06F 8/63: {Image based installation; Cloning; Build to order} - G06F 8/433: {Dependency analysis; Data or control flow analysis} - G06F 16/90344: {by using string matching techniques} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods, computer program products, and systems are presented. The method computer program products, and systems can include, for instance: examining target application container configuration data to identify one or more target container base image referenced in the target application container configuration: subjecting script data associated to the one or more target container base image to text based processing for evaluation of security risk associated to the one or more container base image, the script data obtained from at least one candidate hosting computing environment; and selecting a hosting computing environment from the at least one computing environment for hosting the target application container, the selecting in dependence on the text based processing. ## Claims ### Claim 1 A computer implemented method comprising: examining target application container configuration data to identify one or more target container base image referenced in the target application container configuration: subjecting script data associated to the one or more target container base image to text based processing, wherein the text based processing comprises a text string associated with a confidence level, for evaluation of security risk associated to the one or more target container base image, the script data obtained from at least one candidate hosting computing environment; selecting a hosting computing environment from the at least one computing environment for hosting a target application container, the selecting in dependence on the text based processing; and iteratively performing the text based processing for evaluation of security risk and the selecting the hosting computing environment, wherein the method includes hosting the target application container on a first computing environment, and re-hosting the target application container on a second computing environment having a threshold satisfying a security performance level, responsively to a determination using the text based processing that the second computing environment poses reduced security risk relative to the first computing environment. ### Claim 2 (depends on 1) The computer implemented method of claim 1, wherein the method includes sending script data request data to at least one candidate hosting computing environment for return of one or more script dataset associated to respective ones of the one or more target container base image. ### Claim 3 (depends on 1) The computer implemented method of claim 1, wherein the method includes sending script data request data to at least one candidate hosting computing environment for return of a plurality of script datasets associated to respective ones of the one or more target container base image. ### Claim 4 (depends on 1) The computer implemented method of claim 1, wherein the subjecting script data associated to the one or more target container base image to text based processing for evaluation of security risk associated to the one or more target container base image includes obtaining a set of script datasets defining the script data, and wherein the obtaining includes obtaining script datasets in a restricted set of script dataset classifications, the restricted set of script datasets determined using reinforcement machine learning in which datasets defining script data are removed from an evaluation list. ### Claim 5 (depends on 1) The computer implemented method of claim 1, wherein the text based processing includes identifying whether a specified text string is included in the script data. ### Claim 6 (depends on 1) The computer implemented method of claim 1, wherein the text based processing includes identifying whether a specified text string is included in the script data, returning a pass fail result in dependence on the identifying. ### Claim 7 (depends on 1) The computer implemented method of claim 1, wherein the text based processing includes identifying whether a specified text string is included in the script data, returning a pass fail result in dependence on the identifying, and transforming the pass fail result into one or more qualitative security parameter value, the one or more qualitative security parameter value being selected from a group consisting of an exploitability security parameter value, a prevalence security parameter value and an impact parameter value. ### Claim 8 (depends on 1) The computer implemented method of claim 1, wherein the text based processing includes identifying whether a specified text string is included in the script data, returning a pass fail result associated to a pass fail security test in dependence on the identifying, and transforming the pass fail result into an exploitability security parameter value, and wherein the transforming includes performing online searching of online security literature using text of the pass fail security test. ### Claim 9 (depends on 1) The computer implemented method of claim 1, wherein the method includes iteratively performing the text based processing and the selecting the hosting computing environment. ### Claim 10 (depends on 1) The computer implemented method of claim 1, wherein the method includes initially hosting the target application container on a first computing environment, and re-hosting the target application container on the second computing environment, responsively to the determination using the text based processing that the second computing environment poses reduced security risk relative to the first computing environment. ### Claim 11 (depends on 1) The computer implemented method of claim 1, wherein the examining target application container configuration data to identify one or more target container base image referenced in the target application container configuration includes examining target application container configuration data to identify a plurality of target container base images referenced in the target application container, and wherein the script data obtained from the at least one candidate hosting computing environment is defined by script datasets respectively received from respective first and second computing environments. ### Claim 12 (depends on 1) The computer implemented method of claim 1, wherein the examining target application container configuration data to identify one or more target container base image referenced in the target application container configuration includes examining target application container configuration data to identify a plurality of target container base images referenced in the target application container, and wherein the script data obtained from the at least one candidate hosting computing environment is defined by script datasets respectively received from respective first and second computing environments of a plurality of candidate hosting computing environments, wherein the method includes iteratively performing the text based processing and the selecting the hosting computing environment, wherein the method includes hosting the target application container on a first computing environment, and re-hosting the target application container on a second computing environment, responsively to a determination using the text based processing that the second computing environment poses reduced security risk relative to the first computing environment. ### Claim 13 (depends on 1) The computer implemented method of claim 1, wherein the examining target application container configuration data to identify one or more target container base image referenced in the target application container configuration includes examining target application container configuration data to identify a plurality of target container base images referenced in the target application container, and wherein the script data obtained from the at least one candidate hosting computing environment is defined by script datasets respectively received from respective first and second computing environments of a plurality of candidate hosting computing environments, wherein the method includes iteratively performing the text based processing and the selecting the hosting computing environment, wherein the method includes hosting the target application container on a first computing environment, and re-hosting the target application container on a second computing environment, responsively to a determination using the text based processing that the second computing environment poses reduced security risk relative to the first computing environment, wherein the method includes sending script data request data to each of the plurality of candidate hosting computing environments for return of a plurality of script datasets associated to respective ones of the plurality of target container base images. ### Claim 14 (depends on 1) The computer implemented method of claim 1, wherein the examining target application container configuration data to identify one or more target container base image referenced in the target application container configuration includes examining target application container configuration data to identify a plurality of target container base images referenced in the target application container, and wherein the script data obtained from the at least one candidate hosting computing environment is defined by script datasets respectively received from respective first and second computing environments of a plurality of candidate hosting computing environments, wherein the method includes iteratively performing the text based processing and the selecting the hosting computing environment, wherein the method includes hosting the target application container on a first computing environment, and re-hosting the target application container on a second computing environment, responsively to a determination using the text based processing that the second computing environment poses reduced security risk relative to the first computing environment, wherein the method includes sending script data request data to each of the plurality of candidate hosting computing environments for return of a plurality of script datasets associated to respective ones of the plurality of target container base images, wherein the subjecting script data associated to the one or more target container base image to text based processing for evaluation of security risk associated to the one or more target container base image includes obtaining a set of script datasets defining the script data, and wherein the obtaining includes obtaining script datasets in a restricted set of script dataset classifications, the restricted set of script datasets determined using reinforcement machine learning in which datasets defining script data are removed from an evaluation list in dependence on an effect level criterion. ### Claim 15 (depends on 1) The computer implemented method of claim 1, wherein the examining target application container configuration data to identify one or more target container base image referenced in the target application container configuration includes examining target application container configuration data to identify a plurality of target container base images referenced in the target application container, and wherein the script data obtained from the at least one candidate hosting computing environment is defined by script datasets respectively received from respective first and second computing environments of a plurality of candidate hosting computing environments, wherein the method includes iteratively performing the text based processing and the selecting the hosting computing environment, wherein the method includes hosting the target application container on a first computing environment, and re-hosting the target application container on a second computing environment, responsively to a determination using the text based processing that the second computing environment poses reduced security risk relative to the first computing environment, wherein the method includes sending script data request data to each of the plurality of candidate hosting computing environments for return of a plurality of script datasets associated to respective ones of the plurality of target container base images, wherein the subjecting script data associated to the one or more target container base image to text based processing for evaluation of security risk associated to the one or more target container base image includes obtaining a set of script datasets defining the script data, and wherein the obtaining includes obtaining script datasets in a restricted set of script dataset classifications, the restricted set of script datasets determined using reinforcement machine learning in which datasets defining script data are removed from an evaluation list in dependence on an effect level criterion, wherein the text based processing includes identifying whether a specified text string is included in the script data, and returning a pass fail result in dependence on the identifying. ### Claim 16 (depends on 1) The computer implemented method of claim 1, wherein the examining target application container configuration data to identify one or more target container base image referenced in the target application container configuration includes examining target application container configuration data to identify a plurality of target container base images referenced in the target application container, and wherein the script data obtained from the at least one candidate hosting computing environment is defined by script datasets respectively received from respective first and second computing environments of a plurality of candidate hosting computing environments, wherein the method includes iteratively performing the text based processing and the selecting the hosting computing environment, wherein the method includes hosting the target application container on a first computing environment, and re-hosting the target application container on a second computing environment, responsively to a determination using the text based processing that the second computing environment poses reduced security risk relative to the first computing environment, wherein the method includes sending script data request data to each of the plurality of candidate hosting computing environments for return of a plurality of script datasets associated to respective ones of the plurality of target container base images, wherein the subjecting script data associated to the one or more target container base image to text based processing for evaluation of security risk associated to the one or more target container base image includes obtaining a set of script datasets defining the script data, and wherein the obtaining includes obtaining script datasets in a restricted set of script dataset classifications, the restricted set of script datasets determined using reinforcement machine learning in which datasets defining script data are removed from an evaluation list in dependence on an effect level criterion, wherein the text based processing includes identifying whether a specified text string is included in the script data, returning a pass fail result in dependence on the identifying, and transforming the pass fail result into one or more qualitative security parameter value, the one or more qualitative security parameter value being selected from the group consisting of an exploitability security parameter value, a prevalence security parameter value and an impact parameter value. ### Claim 17 (depends on 1) The computer implemented method of claim 1, wherein the examining target application container configuration data to identify one or more target container base image referenced in the target application container configuration includes examining target application container configuration data to identify a plurality of target container base images referenced in the target application container, and wherein the script data obtained from the at least one candidate hosting computing environment is defined by script datasets respectively received from respective first and second computing environments of a plurality of candidate hosting computing environments, wherein the method includes iteratively performing the text based processing and the selecting the hosting computing environment, wherein the method includes hosting the target application container on a first computing environment, and re-hosting the target application container on a second computing environment, responsively to a determination using the text based processing that the second computing environment poses reduced security risk relative to the first computing environment, wherein the method includes sending script data request data to each of the plurality of candidate hosting computing environments for return of a plurality of script datasets associated to respective ones of the plurality of target container base images, wherein the subjecting script data associated to the one or more target container base image to text based processing for evaluation of security risk associated to the one or more target container base image includes obtaining a set of script datasets defining the script data, and wherein the obtaining includes obtaining script datasets in a restricted set of script dataset classifications, the restricted set of script datasets determined using reinforcement machine learning in which datasets defining script data are removed from an evaluation list in dependence on an effect level criterion, wherein the text based processing includes identifying whether a specified text string is included in the script data, returning a pass fail result associated to a pass fail security test in dependence on the identifying, and transforming the pass fail result into an exploitability security parameter value, and wherein the transforming includes performing online searching of online security literature using text of the pass fail security test. ### Claim 18 (depends on 1) The computer implemented method of claim 1, wherein the examining target application container configuration data to identify one or more target container base image referenced in the target application container configuration includes examining target application container configuration data to identify a plurality of target container base images referenced in the target application container, and wherein the script data obtained from the at least one candidate hosting computing environment is defined by script datasets respectively received from respective first and second computing environments of a plurality of candidate hosting computing environments, wherein the method includes iteratively performing the text based processing and the selecting the hosting computing environment, wherein the method includes hosting the target application container on a first computing environment, and re-hosting the target application container on a second computing environment, responsively to a determination using the text based processing that the second computing environment poses reduced security risk relative to the first computing environment, wherein the method includes sending script data request data to each of the plurality of candidate hosting computing environments for return of a plurality of script datasets associated to respective ones of the plurality of target container base images, wherein the subjecting script data associated to the one or more target container base image to text based processing for evaluation of security risk associated to the one or more target container base image includes obtaining a set of script datasets defining the script data, and wherein the obtaining includes obtaining script datasets in a restricted set of script dataset classifications, the restricted set of script datasets determined using reinforcement machine learning in which datasets defining script data are removed from an evaluation list in dependence on an effect level criterion, wherein the text based processing includes identifying whether a specified text string is included in the script data, returning a pass fail result in dependence on the identifying, and transforming the pass fail result into a plurality of qualitative security parameter value, the plurality of security parameter values including an exploitability security parameter value, a prevalence security parameter value and an impact parameter value, wherein the text based processing includes identifying whether a specified text string is included in the script data, returning a pass fail result associated to a pass fail security test in dependence on the identifying, and transforming the pass fail result into an exploitability security parameter value, and wherein the transforming includes performing online searching of online security literature using text of the pass fail security test. ### Claim 19 A computer program product comprising: a computer readable storage medium readable by one or more processing circuit and storing instructions for execution by one or more processor for performing a method comprising: examining target application container configuration data to identify one or more target container base image referenced in the target application container configuration: subjecting script data associated to the one or more target container base image to text based processing, wherein the text based processing comprises a text string associated with a confidence level, for evaluation of security risk associated to the one or more target container base image, the script data obtained from at least one candidate hosting computing environment; selecting a hosting computing environment from the at least one computing environment for hosting a target application container, the selecting in dependence on the text based processing; and iteratively performing the text based processing for evaluation of security risk and the selecting the hosting computing environment, wherein the method includes hosting the target application container on a first computing environment, and re-hosting the target application container on one or more computing nodes of a computing environment, responsively to a determination using the text based processing that the second computing environment poses reduced security risk relative to the first computing environment. ### Claim 20 A system comprising: a memory; at least one processor in communication with the memory; and program instructions executable by one or more processor via the memory to perform a method comprising: examining target application container configuration data to identify one or more target container base image referenced in the target application container configuration: subjecting script data associated to the one or more target container base image to text based processing, wherein the text based processing comprises a text string associated with a confidence level, for evaluation of security risk associated to the one or more target container base image, the script data obtained from at least one candidate hosting computing environment; selecting a hosting computing environment from the at least one computing environment for hosting a target application container, the selecting in dependence on the text based processing; evaluating a security performance level of one or more target container base image and a target application container; and iteratively performing the text based processing for evaluation of security risk and the selecting the hosting computing environment, wherein the method includes hosting the target application container on a first computing environment, and re-hosting the target application container on a second computing environment having a threshold satisfying the security performance level, responsively to a determination using the text based processing that the second computing environment poses reduced security risk relative to the first computing environment.