Immutable image for deployment to edge devices
One example method includes creating an image definition file, using the image definition file to create an image that is deployable to an edge device, copying an agent into the image, stripping any user passwords out of the image, and removing any unnecessary packages from the image, and after the stripping and the removing, the image becomes an immutable image. The immutable image may then be deployed to a group of edge devices, and one or more layers of the immutable image may be updated by the agent.
1. A method, comprising operations of:
creating an image definition file;
using the image definition file to create an image that has a full operating system and is to be deployed to an edge device;
copying an agent into the image, wherein only the agent residing on the edge device is able to make modification to the edge device;
stripping all user passwords from the image so that no user can log into the edge device after all user passwords are stripped from the image; and
removing any unnecessary packages, which do not have any dependency relations with other packages within the image, from the image by evaluating a package dependency tree,
wherein after the stripping and the removing, the image becomes an immutable image, which is configured for continuous deployment to the edge device.
2. The method as recited in claim 1 , further comprising pushing the immutable image to an image registry.
3. The method as recited in claim 2 , further comprising, after the immutable image is pushed to the image registry, deploying the immutable image to a simulator and using the simulator to perform testing on the immutable image.
4. The method as recited in claim 2 , further comprising, after the immutable image is pushed to the image registry, deploying the immutable image to the edge device.
5. The method as recited in claim 1 , wherein the agent is operable to download, to the edge device, only layers of the image that have been updated.
6. The method as recited in claim 1 , wherein the image comprises immutable driver, operating system (OS), and firmware layers.
7. The method as recited in claim 1 , wherein the image comprises a software layer.
8. The method as recited in claim 1 , further comprising performing an ongoing attestation verification to ensure that the image has not been subjected to unauthorized changes or access.
9. The method as recited in claim 1 , further comprising performing an encryption at rest process for data stored at the edge device.
10. The method as recited in claim 1 , further comprising upgrading the image using information obtained from a learning process, and preserving data at the edge device during and after the upgrading of the image.
11. A non-transitory computer readable storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
creating an image definition file;
using the image definition file to create an image that has a full operating system and is to be deployed to an edge device;
copying an agent into the image, wherein only the agent residing on the edge device is able to make modification to the edge device;
stripping all user passwords from the image so that no user can log into the edge device after all user passwords are stripped from the image; and
removing any unnecessary packages, which do not have any dependency relations with other packages within the image, from the image by evaluating a package dependency tree,
wherein after the stripping and the removing, the image becomes an immutable image, which is configured for continuous deployment to the edge device.
12. The non-transitory computer readable storage medium as recited in claim 11 , further comprising pushing the immutable image to an image registry.
13. The non-transitory computer readable storage medium as recited in claim 12 , further comprising, after the immutable image is pushed to the image registry, deploying the immutable image to a simulator and using the simulator to perform testing on the immutable image.
14. The non-transitory computer readable storage medium as recited in claim 12 , further comprising, after the immutable image is pushed to the image registry, deploying the immutable image to the edge device.
15. The non-transitory computer readable storage medium as recited in claim 11 , wherein the agent is operable to download, to the edge device, only layers of the image that have been updated.
16. The non-transitory computer readable storage medium as recited in claim 11 , wherein the image comprises immutable driver, operating system (OS), and firmware layers.
17. The non-transitory computer readable storage medium as recited in claim 11 , wherein the image comprises a software layer.
18. The non-transitory computer readable storage medium as recited in claim 11 , further comprising performing an ongoing attestation verification to ensure that the image has not been subjected to unauthorized changes or access.
19. The non-transitory computer readable storage medium as recited in claim 11 , further comprising performing an encryption at rest process for data stored at the edge device.
20. The non-transitory computer readable storage medium as recited in claim 11 , further comprising preserving data at the edge device during and after an image upgrade process.