Security scanning of image for virtual machine creation
Embodiments provide automated security scanning of incoming images for use in creating containers such as a Virtual Machines. Based upon attribute(s) of metadata of the incoming image, a security engine chooses from amongst stored scripts for mounting and execution by installation logic. Such scripts can relate to the scanning itself, and/or pre-scanning considerations (such as scan frequency). In one example, the meta data attribute identifies a relevant Operating System (OS) of the incoming image. Other meta data attributes such as •scan frequency, •most recent passed scan, •log information, and •contact information (for issuance of a possible alert), may also be considered as part of the processing of an incoming image. Embodiments may enhance security by avoiding introduction of vulnerabilities through image instantiation. Embodiments may also impart flexibility to conserve resources by selectively scanning according to a frequency and/or date of last successful passage of the image.
1. A method comprising:
receiving an image;
referencing a first attribute of meta data of the image to choose a security scan script stored in a non-transitory computer-readable storage medium;
referencing the first attribute to choose a security pre-scan script stored in the non-transitory computer readable storage medium;
mounting the security scan script from the non-transitory computer-readable storage medium for execution by an installation logic to create a container from the image, wherein installation of the image is stopped based on an error issued by the security scan script; and
mounting the security pre-scan script for execution by the installation logic, wherein execution of the security scan script is bypassed based upon a second attribute of meta data of the image examined by the security pre-scan script.
2. A method as in claim 1 wherein the first attribute identifies an operating system (OS).
3. A method as in claim 1 wherein the container comprises a Virtual Machine.
4. A method as in claim 1 wherein:
the first attribute identifies an operating system (OS); and
the second attribute indicates a frequency.
5. A method as in claim 1 wherein:
the first attribute identifies an operating system (OS); and
the second attribute indicates a last good security scan of the image.
6. A method as in claim 1 further comprising:
referencing the first attribute to choose a particular security pre-scan script stored in the non-transitory computer readable storage medium; and
mounting the particular security pre-scan script for execution by the installation logic, wherein the pre-scan script causes an alert to be issued to a contact identified by a second attribute of image meta data.
7. A method as in claim 1 wherein:
the non-transitory computer readable storage medium comprises an in-memory database; and
the referencing to choose the security scan script and the referencing to choose the security pre-scan script are performed by an in-memory database engine of the in-memory database.
8. A method as in claim 7 wherein:
the image is received from an archive; and
the archive comprises the in-memory database.
9. A method as in claim 1 wherein executing the security scan script further comprises specifying that the security scan script is executed before a plurality of original image instantiation logic scripts.
10. A non-transitory computer readable storage medium embodying a computer program for performing a method, said method comprising:
receiving an image;
referencing a first attribute of meta data of the image to choose a security scan script stored in the non-transitory computer readable storage medium;
referencing the first attribute to choose a security pre-scan script stored in the non-transitory computer readable storage medium;
mounting the security scan script from the non-transitory computer readable medium for execution by an installation logic to create a container from the image, wherein installation of the image is stopped based on an error issued by the security scan script; and
mounting the security pre-scan script for execution by the installation logic, wherein execution of the security scan script is bypassed based upon a second attribute of meta data of the image examined by the security pre-scan script.
11. A non-transitory computer readable storage medium as in claim 10 wherein:
the first attribute identifies an operating system; and
the second attribute indicates frequency.
12. A non-transitory computer readable storage medium as in claim 10 wherein:
the first attribute identifies an operating system; and
the second attribute indicates a last good security scan of the image.
13. A non-transitory computer readable storage medium as in claim 10 wherein the container comprises a Virtual Machine (VM).
14. A non-transitory computer readable storage medium as in claim 10 wherein:
the non-transitory computer readable storage medium comprises an in-memory database;
the image is received from an archive stored in the in-memory database; and
the referencing to choose the security scan script and the referencing to choose the security pre-scan script are performed by an in-memory database engine of the in-memory database.
15. A computer system comprising:
one or more processors;
one or more memories;
a software program, executable on said computer system, the software program configured to cause an in-memory database engine of an in-memory database to:
receive an image;
reference a first attribute of meta data of the image to choose a security scan script stored in the in-memory database;
reference the first attribute to choose a security pre-scan script stored in the in-memory database;
mount the security scan script from the in-memory database for execution by an installation logic to create a container from the image, wherein installation of the image is stopped based on an error issued by the security scan script; and
mount the security pre-scan script for execution by the installation logic, wherein execution of the security scan script is bypassed based upon a second attribute of meta data of the image examined by the security pre-scan script.
16. A computer system as in claim 15 wherein the first attribute identifies an operating system.
17. A computer system as in claim 15 wherein the container comprises a virtual machine.
18. A computer system as in claim 15 wherein the second attribute indicates a frequency.
19. A computer system as in claim 15 wherein the second attribute indicates a last good security scan of the image.
20. A computer system as in claim 15 wherein executing the security scan script further comprises specifying that the security scan script is executed before a plurality of original image instantiation logic scripts.