Optimizing container image encryption
One example method includes packaging a containerized application into at least two images. The first image may include the main application and the second image includes a decryptor. Sensitive information associated with the application is encrypted and included in the second image. The decryptor operates separately from the main application. After the decryptor successfully completes, the main application is run. The main application may include a copier layer to copy any data decrypted by the decryptor into the main application.
1. A method, comprising:
packaging an application that is associated with sensitive data into at least a first image and a second image by placing first layers in the first image, the first layers including a copier layer configured to perform copying and by placing second layers in the second image, wherein the second layers include a decryptor layer configured to perform decryption and an encrypted layer that includes the sensitive data in an encrypted form;
configuring the second image to run before the first image;
running the second image as an initialization container and running the first image as a main container after the initialization container, wherein execution of the initialization container includes decrypting, by the decryptor, the encrypted layer to obtain decrypted sensitive data; and
running the copier layer, wherein the copier layer copies the decrypted sensitive data.
2. The method of claim 1 , further comprising storing the decrypted sensitive data in a directory of a filesystem.
3. The method of claim 2 , further comprising running the first image as the main container after the initialization container successfully completes.
4. The method of claim 3 , further comprising running the copier layer, wherein the copier layer copies the decrypted sensitive data in the directory to a location in a layer root directory associated with the main container, which includes a main application.
5. The method of claim 1 , further comprising generating a pod specification such that the second image runs and completes before the first image is run.
6. The method of claim 1 , further comprising generating the encrypted layer by encrypting one or more sensitive layers of the sensitive data.
7. The method of claim 1 , wherein packaging the application includes dividing an image into the first image and the second image or constructing a command file for the first image and a command file for the second image.
8. The method of claim 7 , further comprising placing the decryptor layer in the second image such that the decryptor layer in the second image is not dependent on an operating system included in the first image.
9. The method of claim 1 , further comprising creating the first image and the second image.
10. A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
packaging an application that is associated with sensitive data into at least a first image and a second image by placing first layers in the first image, the first layers including a copier layer configured to perform copying and by placing second layers in the second image, wherein the second layers include a decryptor layer configured to perform decryption and an encrypted layer that includes the sensitive data in an encrypted form;
configuring the second image to run before the first image;
running the second image as an initialization container and running the first image as a main container after the initialization container, wherein execution of the initialization container includes decrypting, by the decryptor, the encrypted layer to obtain decrypted sensitive data; and
running the copier layer, wherein the copier layer copies the decrypted sensitive data.
11. The non-transitory storage medium of claim 10 , further comprising storing the decrypted sensitive data in a directory of a filesystem.
12. The non-transitory storage medium of claim 11 , further comprising running the first image as the main container after the initialization container successfully completes.
13. The non-transitory storage medium of claim 12 , further comprising running the copier layer, wherein the copier layer copies the decrypted sensitive data to a location in a layer root directory associated with the main container, which includes a main application.
14. The non-transitory storage medium of claim 10 , further comprising generating a pod specification such that the second image runs and completes before the first image is run.
15. The non-transitory storage medium of claim 10 , further comprising generating the encrypted layer by encrypting one or more sensitive layers of the sensitive data.
16. The non-transitory storage medium of claim 10 , wherein packaging the application includes dividing an image into the first image and the second image or constructing a command file for the first image and a command file for the second image.
17. The non-transitory storage medium of claim 16 , further comprising placing the decryptor layer in the second image such that the decryptor layer in the second image is not dependent on an operating system included in the first image.
18. The non-transitory storage medium of claim 10 , the second image including a signal layer and a stop-signal layer that identify a location of the encrypted layer in the second image.