Intelligent container resource placement based on container image vulnerability assessment
AssigneeInternational Business Machines Corporation
InventorsPhilip F. Estes, Briana Frank, Jason R. McGee, Lin Sun
Life of this patent
Estimating the term…
Abstract
Determining placement of cloud resources and containers relative to nodes in a cloud managed platform by using placement criteria and leveraging image vulnerability input. Based on the vulnerability input and resource management, containers with similar vulnerabilities are placed on a same node.
Claims19
A method of placement of a container in an isolated computing space of a system comprising a plurality of isolated computing spaces, comprising the steps of:
- a container storage engine receiving a request for placing a first container in an isolated computing space of the system;
- the container storage engine evaluating a vulnerability of the first container;
- the container storage engine evaluating a vulnerability of other previously-stored containers present within the plurality of isolated computing spaces;
- the container storage engine comparing the vulnerability of the first container with the vulnerability of the previously-stored containers present within the plurality of isolated computing spaces, to determine a previously-stored container with a vulnerability which matches the vulnerability of the first container;
- and
- the container storage engine placing the first container in the isolated computing space of the system with the previously-stored container with the vulnerability which matches the vulnerability of the first container.
A computer program product for placement of a container in an isolated computing space of a system comprising a plurality of isolated computing spaces, the computer program product comprising a container storage engine comprising a computer comprising at least one processor, one or more memories, one or more computer readable storage media, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by the computer to perform a method comprising:
- receiving, by the container storage engine, a request for placing a first container in an isolated computing space of the system;
- evaluating, by the container storage engine, a vulnerability of the first container;
- evaluating, by the container storage engine, a vulnerability of other previously-stored containers present within the plurality of isolated computing spaces;
- comparing, by the container storage engine, the vulnerability of the first container with the vulnerability of the previously-stored containers present within the plurality of isolated computing spaces, to determine a previously-stored container with a vulnerability which matches the vulnerability of the first container;
- and
- placing, by the container storage engine, the first container in the isolated computing space of the system with the previously-stored container with the vulnerability which matches the vulnerability of the first container.
A computer system for placement of a container in an isolated computing space of a system comprising a plurality of isolated computing spaces, a container storage engine of the computer system comprising a computer comprising at least one processor, one or more memories, one or more computer readable storage media having program instructions executable by the computer to perform the program instructions comprising:
- receiving, by the container storage engine, a request for placing a first container in an isolated computing space of the system;
- evaluating, by the container storage engine, a vulnerability of the first container;
- evaluating, by the container storage engine, a vulnerability of other previously-stored containers present within the plurality of isolated computing spaces;
- comparing, by the container storage engine, the vulnerability of the first container with the vulnerability of the previously-stored containers present within the plurality of isolated computing spaces, to determine a previously-stored container with a vulnerability which matches the vulnerability of the first container;
- and
- placing, by the container storage engine, the first container in the isolated computing space of the system with the previously-stored container with the vulnerability which matches the vulnerability of the first container.
Dependencies are inferred from the claim text.