Secure container image builds

1. A method comprising:

determining, by a container image builder executing on a computing device, that a first container image is to be built;

initiating, by the container image builder, a build container from a build container image;

identifying, by the build container, a first dependency to be incorporated into the first container image;

accessing, by the build container, vulnerability data that identifies a plurality of dependencies that have one or more vulnerabilities;

based on the vulnerability data, determining that the first dependency is devoid of vulnerabilities; and

in response to determining that the first dependency is devoid of vulnerabilities, generating the first container image to include the first dependency.

2. The method of claim 1 wherein determining that the first container image is to be built comprises receiving, by the container image builder from an application, a request to build the first container image, the request including information identifying a location of application information regarding a first application to be included in the first container image.

3. The method of claim 1 wherein initiating the build container comprises:

analyzing, by the container image builder, an application file that will be used to build the first container image; and

based on an attribute of the application file, selecting the build container image from a plurality of different build container images.

4. The method of claim 1 wherein identifying the first dependency comprises accessing a configuration file that identifies a plurality of dependencies, including the first dependency, that are to be included in the first container image.

5. The method of claim 1 further comprising:

causing a vulnerability checking application to be inserted into the first container image; and

causing the vulnerability checking application to be a first initiated application upon initiation of a container from the first container image.

6. The method of claim 1 further comprising:

determining, by the container image builder, that a second container image is to be built;

initiating, by the container image builder, the build container from the build container image;

identifying, by the build container, a second dependency to be incorporated into the second container image;

accessing, by the build container, the vulnerability data that identifies the plurality of dependencies that have one or more vulnerabilities;

based on the vulnerability data, determining that the second dependency contains a vulnerability; and

taking an action based on determining that the second dependency contains the vulnerability.

7. The method of claim 6 wherein taking the action comprises inhibiting a generation of the second container image.

8. The method of claim 6 wherein taking the action comprises:

identifying a version of the second dependency;

identifying a third dependency that is a different version of the second dependency and that is devoid of vulnerabilities; and

generating the second container image to include the third dependency in lieu of the second dependency.

9. The method of claim 6 wherein taking the action comprises:

sending an alert indicating that the second dependency contains the vulnerability;

receiving a response that authorizes generation of the second container image; and

generating the second container image to include the second dependency.

10. The method of claim 1 further comprising:

generating the build container image to include a vulnerability extension that is configured to:

identify one or more dependencies of a container image to be built; and

access the vulnerability data to determine whether any dependency of the one or more dependencies of the container image to be built contains a vulnerability.

11. The method of claim 10 further comprising:

modifying a Maven build automation tool to include the vulnerability extension that is invoked by the Maven build automation tool; and

generate the build container image to include the Maven build automation tool.

12. A computer system, comprising:

one or more processor devices of one or more computing devices to:

determine, by a container image builder, that a first container image is to be built;

initiate, by the container image builder, a build container from a build container image;

identify, by the build container, a first dependency to be incorporated into the first container image;

access, by the build container, vulnerability data that identifies a plurality of dependencies that have one or more vulnerabilities;

based on the vulnerability data, determine that the first dependency is devoid of vulnerabilities; and

in response to determining that the first dependency is devoid of vulnerabilities, generate the first container image to include the first dependency.

13. The computer system of claim 12 wherein to identify the first dependency the one or more processor devices are further to access a configuration file that identifies a plurality of dependencies, including the first dependency, that are to be included in the first container image.

14. The computer system of claim 12 where the one or more processor devices are further to:

cause a vulnerability checking application to be inserted into the first container image; and

cause the vulnerability checking application to be a first initiated application upon initiation of a container from the first container image.

15. The computer system of claim 12 wherein the one or more processor devices are further to:

determine, by the container image builder, that a second container image is to be built;

initiate, by the container image builder, the build container from the build container image;

identify, by the build container, a second dependency to be incorporated into the second container image;

access, by the build container, the vulnerability data that identifies the plurality of dependencies that have one or more vulnerabilities;

based on the vulnerability data, determine that the second dependency contains a vulnerability; and

take an action based on determining that the second dependency contains the vulnerability.

16. The computer system of claim 15 wherein to take the action the one or more processor devices are further to:

identify a version of the second dependency;

identify a third dependency that is a different version of the second dependency and that is devoid of vulnerabilities; and

generate the second container image to include the third dependency in lieu of the second dependency.

17. A non-transitory computer-readable storage medium that includes executable instructions configured to cause one or more processor devices of one or more computing devices to:

determine, by a container image builder, that a first container image is to be built;

initiate, by the container image builder, a build container from a build container image;

identify, by the build container, a first dependency to be incorporated into the first container image;

access, by the build container, vulnerability data that identifies a plurality of dependencies that have one or more vulnerabilities;

based on the vulnerability data, determine that the first dependency is devoid of vulnerabilities; and

in response to determining that the first dependency is devoid of vulnerabilities, generate the first container image to include the first dependency.

18. The non-transitory computer-readable storage medium of claim 17 wherein to identify the first dependency the instructions further cause the one or more processor devices to access a configuration file that identifies a plurality of dependencies, including the first dependency, that are to be included in the first container image.

19. The non-transitory computer-readable storage medium of claim 17 wherein the instructions further cause the one or more processor devices to:

cause a vulnerability checking application to be inserted into the first container image; and

cause the vulnerability checking application to be a first initiated application upon initiation of a container from the first container image.

20. The non-transitory computer-readable storage medium of claim 17 wherein the instructions further cause the one or more processor devices to:

determine, by the container image builder, that a second container image is to be built;

initiate, by the container image builder, the build container from the build container image;

identify, by the build container, a second dependency to be incorporated into the second container image;

access, by the build container, the vulnerability data that identifies the plurality of dependencies that have one or more vulnerabilities;

based on the vulnerability data, determine that the second dependency contains a vulnerability; and

take an action based on determining that the second dependency contains the vulnerability.