Software container registry service
A request to store a container image is received from a device associated with a customer of a computing resource service provider. Validity of a security token associated with the request is authenticated using a cryptographic key maintained as a secret by the computing resource service provider. One or more layers of the container image is built based at least in part on at least one build artifact to form a set of built layers. The software image including the set of built layers is stored in a repository associated with the customer. A manifest of metadata for the set of built layers is stored in a database of a structured data store. The container image is obtained in the form of an obtained container image. The obtained container image is deployed as the software container in at least one virtual machine instance associated with the customer.
1. A computer-implemented method, comprising:
receiving a first request to store, in a data object store assigned to an account maintained by a computing resource service provider, a software image comprising a set of image layers, the first request including a token usable at least in part in authenticating the first request; and
as a result of the token being determined to be authentic and valid to authorize the first request to be fulfilled:
storing the software image including the set of image layers in the data object store associated with the account;
storing metadata about the software image in structured storage different from the data object store;
receiving a second request to deploy the software image to one or more container instances;
obtaining the software image from the data object store based at least in part on the metadata in the structured storage; and
deploying the software image in the one or more container instances in accordance with the second request.
2. The computer-implemented method of claim 1 , wherein:
the one or more container instances are configured to execute a software application;
the second request is received from an automated build service according to a predefined deployment scheme that specifies that a latest version of the software application is to be automatically deployed to replace a previous version of the software application; and
the computer-implemented method further comprises, as a result of determining, according to the predefined deployment scheme, that the software image is an image of the latest version of the software application and that the software application executing in the one or more container instances is the previous version:
terminating execution of the previous version of the software application in the one or more container instances; and
launching the software image to execute in the one or more container instances.
3. The computer-implemented method of claim 1 , wherein the second request is received through an application programming interface from a device associated with a customer of the computing resource service provider.
4. The computer-implemented method of claim 1 , further comprising determining the token to be authentic and valid by at least:
decrypting the token using a key shared as a secret between an entity associated with the account and the computing resource service provider to form a set of credentials and a restriction;
authenticating that the set of credentials are credentials of associated the entity;
determining that the entity is authorized to have the software image stored in the data object store; and
determining, based at least in part on the restriction, that the token is valid.
5. The computer-implemented method of claim 1 , further comprising:
receiving, from the one or more container instances to which the software image was deployed, a first application programming interface request corresponding to a first container engine type;
translating the first application programming interface request into a second application programming interface request having a format that corresponds to a second container engine type; and
providing the second application programming interface request to a service that processes requests of the format that corresponds to the second container engine type.
6. The computer-implemented method of claim 1 , wherein:
the computer-implemented method further comprises converting the software image to a second software image of a second container engine type comprising a second set of image layers; and
storing software image including the set of image layers includes storing the second set of image layers corresponding to the second software image in the data object store to form the software image.
7. The computer-implemented method of claim 1 , wherein:
the first request includes a build artifact for the software image; and
the computer-implemented method further comprises:
storing the build artifact at a managed source control service; and
building the set of image layers of the software image from the build artifact.
8. The computer-implemented method of claim 7 , further comprising,
dependent upon successfully building the set of image layers, scheduling deployment of the software image to the one or more container instances in accordance with a deployment strategy specified by an individual associated with the account.
9. A system, comprising:
one or more processors; and
memory including executable instructions that, as a result of execution by the one or more processors, cause the system to:
receive, from a device associated with a customer of a computing resource service provider, a request to store a container image, the container image being an image that is deployable as a software container, the request including at least one build artifact for the container image and a security token usable at least in part in authenticating the request as having been authorized by the customer;
authenticate validity of the security token using a cryptographic key maintained as a secret by the computing resource service provider;
build one or more layers of the container image based at least in part on at least the one build artifact to form a set of built layers;
store the set of built layers in a repository associated with the customer to form a stored container image;
store a manifest of metadata for the set of built layers in a database of a structured data store, the metadata including storage locations of individual built layers of the set of built layers of the stored container image, the structured data store being different from the repository;
obtain the stored container image in the form of an obtained container image; and
deploy the obtained container image as the software container in at least one virtual machine instance associated with the customer.
10. The system of claim 9 , wherein:
the stored container image is obtained from the repository, based at least in part on the storage locations in the manifest; and
the executable instructions that deploy the obtained container image further include instructions that further cause the system to:
copy the stored container image to a second repository that is physically located in a second geographic region to form a copied container image; and
deploy the copied container image as the software container from the second repository to at least one virtual machine instance associated with the customer that is physically located in the second geographic region.
11. The system of claim 9 , wherein:
the obtained container image is obtained, at least in part, from a set of cached layers; and
the executable instructions that obtain the stored container image further include instructions that further cause the system to:
make a determination, based at least in part on previous deployment activity of one or more virtual machine instances associated with the customer, whether to maintain one or more layers of the set of built layers in cache memory; and
depending at least in part on the determination, maintain the one or more layers of the set of built layers in the cache memory as the set of cached layers.
12. The system of claim 9 , wherein:
the security token is encrypted data that includes credential information of the customer;
the executable instructions further include instructions that further cause the system to:
submit the credential information to an authentication service for validation; and
as a result of receiving an indication of successful validation of the credential information by the authentication service, obtain the security token generated based at least in part on encrypting credential information and at least one restriction to form the encrypted data; and
the executable instructions that authenticate the validity of the security token further include instructions that further cause the system to:
decrypt the encrypted data to produce decrypted credential information and at least one decrypted restriction; and
verify that the decrypted credential information and at least one decrypted restriction authorizes fulfilment of the request to store the container image in the repository.
13. One or more non-transitory computer-readable storage media having collectively stored thereon executable instructions that, as a result of execution by one or more processors of a distributed computer system, cause the distributed computer system to at least:
receive a first request to store, in a data object store assigned to an account maintained by a computing resource service provider, a software image comprising a set of image layers, the first request including a token usable at least in part in authenticating the first request; and
as a result of the token being determined to be authentic and valid to authorize the first request to be fulfilled:
store software image including the set of image layers in the data object store associated with the account;
store metadata about the software image in structured storage different from the data object store;
receive a second request to deploy the software image to one or more container instances;
obtain the software image from the data object store based at least in part on the metadata in the structured storage; and
deploy the software image in the one or more container instances in accordance with the second request.
14. The one or more non-transitory computer-readable storage media of claim 13 , wherein:
the first request includes at least one build artifact for the software image; and
the executable instructions that cause the distributed computer system to receive the first request include instructions that further cause the distributed computer system to:
store at least the one build artifact with a managed source control service; and
build the set of image layers of the software image from at least the one build artifact.
15. The one or more non-transitory computer-readable storage media of claim 13 , wherein the executable instructions that cause the distributed computer system to determine that the token is authentic and valid further include instructions that further cause the distributed computer system to:
decrypt the token using a key shared as a secret between an entity associated with the account and the computing resource service provider to form a set of credentials and a restriction;
authenticate that the set of credentials are credentials of associated the entity;
determine that the entity is authorized to have the software image stored in the data object store; and
determine, based at least in part on the restriction, that the token is valid.
16. The one or more non-transitory computer-readable storage media of claim 13 , wherein:
the executable instructions further include instructions that further cause the distributed computer system to convert the software image to a second software image of a second container engine type comprising a second set of image layers; and
storing the set of image layers includes storing the second set of image layers corresponding to the second software image in the data object store.
17. The one or more non-transitory computer-readable storage media of claim 13 , wherein:
the data object store holds a first version of a software application associated with a tag;
the software image is a second version of the software application; and
the executable instructions further include instructions that further cause the distributed computer system to, as a result of receiving a third request to associate the tag with the second version of the software image:
disassociate the tag with the first version; and
associate the tag with the second version.
18. The one or more non-transitory computer-readable storage media of claim 13 , wherein the executable instructions that cause the distributed computer system to store the set of image layers further include instructions that further cause the distributed computer system to:
scan the set of image layers for a match to one or more specified criteria; and
store, depending at least in part on not finding the match to the one or more specified criteria, the set of image layers in the data object store.
19. The one or more non-transitory computer-readable storage media of claim 13 , wherein:
the first request includes a build artifact for the software image; and
the executable instructions further include instructions that further cause the distributed computer system to:
store the build artifact at a managed source control service; and
build the set of image layers of the software image from the build artifact.
20. The one or more non-transitory computer-readable storage media of claim 19 , wherein the executable instructions further include instructions that further cause the distributed computer system to, dependent upon successfully building the set of image layers, schedule deployment of the software image to the one or more container instances in accordance with a deployment strategy specified by an individual associated with the account.