Secure package installation into a target container
OwnerPavel Tikhomirovinventor
Life of this patent
Estimating the term…
Abstract
Techniques for secure package installation into a target container are described. The described techniques utilize a temporary service container to execute files for installation of a package into a target container. The service container provides an execution environment that is at least partially isolated from a host system and thus package file execution within the service container reduces vulnerability of the host system to potentially unsecure files and processes that may result from file execution.
Claims17
A method, implemented by at least one computing device, for secure installing a package into a target container, the method comprising:
- generating a temporary service container in a host operating system;
- permitting the temporary service container access to a container file system of the target container;
- initiating a package manager to execute, within the temporary service container, one or more executable files located on the container file system of the target container and required for installing the package on the container file system of the target container, wherein the generating the temporary service container and/or the permitting the temporary service container access to a container file system of the target container further comprises mounting into the temporary service container a virtual block device created from a disk image of the target container;
- and
- terminating the temporary service container based on a completion of installing the package, or in response to a command of the host operating system or of the temporary service container.
A system for secure installing a package into a target container comprising:
- one or more processors;
- and
- one or more storage devices comprising processor executable instructions that, responsive to execution by the one or more processors, cause the system to perform operations comprising:
- generating a temporary service container in a host operating system;
- permitting the temporary service container access to a container file system of the target container;
- mounting into the temporary service container a virtual block device created from a disk image of the target container,
- initiating a package manager to execute, within the temporary service container, one or more executable files located on the container file system of the target container and required for installing the package on the container file system of the target container;
- and
- terminating the temporary service container based on a completion of installing the package, or in response to a command of the host operating system or of the temporary service container.
A method, implemented by at least one computing device, for executing package executable instructions as part of secure installing a package into a target container, the method comprising:
- generating a temporary service container, with a package manager mounted within the temporary service container and a target container file system mounted within the temporary service container;
- executing, by the package manager within the temporary service container, executable package management instructions for the package including to execute script file executable instructions;
- executing, based on execution of the script file executable instructions, a binary file accessed from the target container file system to cause installation of an application from the package to the target container via the target container file system;
- wherein the generating the temporary service container and/or permitting the temporary service container access to a container file system of the target container further comprises mounting into the temporary service container a virtual block device created from a disk image of the target container;
- and
- terminating the service container based on completion of installation of the application to the target container, or in response to a command of the host operating system or of the temporary service container.
Dependencies are inferred from the claim text.