US 12,405,923 B2
Validation of container images
Giuseppe Scrivano, Milan (IT); and Alexander Larsson, Stockholm (SE)
Assigned to Red Hat, Inc., Raleigh, NC (US)
Filed by Red Hat, Inc., Raleigh, NC (US)
Filed on Oct. 17, 2023, as Appl. No. 18/488,179.
Prior Publication US 2025/0124002 A1, Apr. 17, 2025
Int. Cl. G06F 16/16 (2019.01); G06F 9/54 (2006.01); G06F 11/07 (2006.01); G06F 11/30 (2006.01)
CPC G06F 16/164 (2019.01) [G06F 9/545 (2013.01); G06F 11/0769 (2013.01); G06F 11/3086 (2013.01)] 17 Claims
OG exemplary drawing
 
1. A method, comprising:
extracting, by a computing system executing a kernel based operating system, a plurality of files from a container image into a filesystem of a container registry of the computing system, the container image comprising a plurality of layers, each file of the plurality of files corresponding to one of the layers of the plurality of layers;
generating, by the computing system, a metadata file that comprises a directory structure of the plurality of files in the filesystem of the container registry, wherein the directory structure points to a plurality of file locations from which the plurality of files can be respectively accessed within the filesystem of the container registry, and wherein the metadata file does not include contents of the plurality of files in the filesystem;
mounting, by the computing system in a kernel of the kernel-based operating system, the metadata file to a mount point, wherein mounting the metadata file causes a first digest of the metadata file to be generated and the metadata file and the plurality of files in the filesystem of the container registry to be read-only, wherein the first digest comprises cryptographic information that identifies a plurality of digests of the plurality of files in the filesystem, and wherein mounting the metadata file further causes a file of the plurality of files to be pulled to the mount point from a first file location of the plurality of file locations pointed to by the metadata file;
subsequent to mounting the metadata file to the mount point, determining, by the computing system, that the filesystem is being accessed;
responsive to determining that the filesystem is being accessed, generating, by the computing system, a second digest of the metadata file;
determining, by the computing system based on a comparison of the first digest to the second digest, that the directory structure of the plurality of files in the filesystem has not changed; and
responsive to determining that the directory structure of the plurality of files has not changed, instantiating, by the computing system, a container using the file pulled to the mount point from the first file location.