Techniques for maintaining image integrity in containerized applications
A system and method for maintaining image integrity in a containerized environment. Image layers of a software container are scanned for metadata. The metadata is indexed and contextual metadata is added. Execution of the containerized environment is monitored to detect new image layers being executed. Integrity of images in the environment is maintained based on integrity rules and the metadata of each image layer. The integrity rules ensure image integrity by ensuring that pulled images are composed from trusted images, image layers are pushed by trusted users, image layers do not include potential vulnerabilities, and image layers do not override specific file paths. Trusted image layers may be automatically detected using a machine learning model trained based on historical image layer metadata.
1. A method for maintaining image integrity in a containerized environment, the containerized environment including a software container composed from a plurality of image layers, the method comprising:
indexing metadata of the software container, wherein the indexed metadata includes a unique signature of each image layer, wherein the signature of each image layer is based on contents of the image layer and of each previous image layer of the plurality of image layers;
determining whether each image layer is trusted based on the indexed metadata and a plurality of integrity rules, wherein determining whether each image layer is trusted further comprises:
determining whether the image layer is composed from a trusted image, and
determining whether the image layer meets the plurality of integrity rules when the image layer is above a known trusted image layer of the plurality of image layers; and
pulling each image layer that is not determined as trusted.
2. The method of claim 1 , wherein determining whether each image layer meets the plurality of integrity rules when the image layer is above a known trusted image layer of the plurality of image layers further comprises:
determining whether the image layer is composed from an image that was pushed by at least one trusted user.
3. The method of claim 1 , wherein determining whether each image layer meets the plurality of integrity rules when the image layer is above a known trusted image layer of the plurality of image layers further comprises:
determining whether the image layer contains at least one potentially vulnerable software package.
4. The method of claim 3 , wherein a software package is potentially vulnerable when at least one of: the software package includes at least one known vulnerability, the software package includes a custom script, and the software package is not up-to-date.
5. The method of claim 1 , wherein determining whether each image layer meets the plurality of integrity rules when the image layer is above a known trusted image layer of the plurality of image layers further comprises:
determining whether the image layer overrides at least one file path.
6. The method of claim 1 , wherein determining whether the image layer is composed from a trusted image is based on the indexed metadata and a machine learning model trained to detect trusted images using a training set including historical indexed metadata of a plurality of historical image layers.
7. The method of claim 6 , wherein the training set metadata includes at least one of: contents of each historical image layer, name of each historical image layer, repository from which an image of each historical image layer was pulled, a set of repositories from which an image of each historical image layer was pulled, geographic location of a source of an image of each historical image layer, and an entity that pulled an image of each historical image layer.
8. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for maintaining image integrity in a containerized environment, the containerized environment including a software container having at least one image layer, the process comprising:
indexing metadata of the software container, wherein the indexed metadata includes a unique signature of each image layer, wherein the signature of each image layer is based on contents of the image layer and of each previous image layer of a plurality of image layers;
determining whether each image layer is trusted based on the indexed metadata and a plurality of integrity rules, wherein determining whether each image layer is trusted further comprises:
determining whether the image layer is composed from a trusted image, and
determining whether the image layer meets the plurality of integrity rules when the image layer is above a known trusted image layer of the plurality of image layers; and
pulling each image layer that is not determined as trusted.
9. A system for maintaining image integrity in a containerized environment, the containerized environment including a software container having at least one image layer, the system comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
index metadata of the software container, wherein the indexed metadata includes a unique signature of each image layer, wherein the signature of each image layer is based on contents of the image layer and of each previous image layer of tho a plurality of image layers;
determine whether each image layer is trusted based on the indexed metadata and a plurality of integrity rules, wherein the system is further configured to:
determine whether the image layer is composed from a trusted image, and
determine whether the image layer meets the plurality of integrity rules when the image layer is above a known trusted image layer of the plurality of image layers; and
pull each image layer that is not determined as trusted.
10. The system of claim 9 , wherein the system is further configured to:
determine whether the image layer is composed from an image that was pushed by at least one trusted user.
11. The system of claim 9 , wherein the system is further configured to:
determine whether the image layer contains at least one potentially vulnerable software package.
12. The system of claim 11 , wherein a software package is potentially vulnerable when at least one of: the software package includes at least one known vulnerability, the software package includes a custom script, and the software package is not up-to-date.
13. The system of claim 9 , wherein the system is further configured to:
determine whether the image layer overrides at least one file path.
14. The system of claim 9 , wherein determining whether the image layer is composed from a trusted image is based on the indexed metadata and a machine learning model trained to detect trusted images using a training set including historical indexed metadata of a plurality of historical image layers.
15. The system of claim 14 , wherein the training set metadata includes at least one of: contents of each historical image layer, name of each historical image layer, repository from which an image of each historical image layer was pulled, a set of repositories from which an image of each historical image layer was pulled, geographic location of a source of an image of each historical image layer, and an entity that pulled an image of each historical image layer.