Container-based baseboard management controllers

A non-transitory storage medium that stores hardware processor-readable instructions that, when executed by a hardware processor of a management controller, cause the management controller to:

• receive, by an execution control engine of the management controller, a request to run a first container;
• and
• responsive to the request:
• determine, by a kernel module of the management controller, whether a cache indicates that an image corresponding to the first container has passed verification, wherein the kernel module is part of an operating system kernel of the management controller;
• based on a result of the determination of whether the cache indicates that the image has passed verification, request a security agent of the management controller to apply a cryptographic hash algorithm to the image to verify the image;
• determine, by the kernel module, that the image successfully passed validation based on one of the cache indicating the image has passed verification or the security agent indicating successful verification of the image;
• and responsive to the kernel module determining that the image successfully passed verification, run the first container to provide a management service to manage a host, wherein the host is associated with a host operating system other than the management operating system kernel of the management controller, and providing the management service comprises operating the management controller independently from the host operating system.

A method comprising:

• hosting, by a baseboard management controller of a computer platform, a container ecosystem to provide services to manage a host of the computer platform, wherein the host is separate from the baseboard management controller and is associated with an operating system that operates independently from the baseboard management controller;
• and managing, by the baseboard management controller, the container ecosystem based on a zero trust policy, wherein the managing comprises:
• intercepting a call to perform a lifecycle operation on a container;
• assuming that the container is untrusted;
• verifying a container object associated with the container;
• and responsive to the container object successfully passing the verification, trusting the container and allowing the call to be executed.