A new Flexera Community experience is coming on November 18th, click here for more information.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Containerized Applications and Data Platform

Hi community members,

we are considering to discover the software installed within Docker containers and implement an additional normalize schedule. Here we face some challenges and we are wondering if anyone from the community has additional ideas how to tackle them.

  • Container and container images
    Since the container instances are deployed and shut down on demand we'd rather focus on the container images as a source for software inventory information. Incorporating every (probably short-lived) container instance into our software inventory doesn't seem to make much sense to us: all instances stemming from the same instance are more or less identical and share the same content. However, data platform cannot properly display the images  because it sticks to the concept of a host computer. We might handle container images as special hosts but are not sure if that works out in the end.
    Or shall we better manage the individual container instances?  Here we might run into deduping issues if multiple similar containers run on the same host.
  • Inventory
    The software within the container images will be deployed by various ways. In some cases even preconfigured contaier images (i.e. from dockerhub) might be used. So we don't have real control on how the installations are made, e.g. add/remove software entries don't really exist.
    We think we have to incorporate a full software scan of the container images to get the full picture. Fortunately enough we've already got an analysis software in place (JFrog XRay) which scans the containers for vulnerabilities and license compliance issues. It lokks as if  this software can also produce a list of all software found in the container image. This list could in turn be imported into data platform. 
    But will data platform properly recognize the data? We don't really want to enter every software into the private catalog.
    Has anyone done that already and could share her/his experiences?   

Any other ideas? Any other input?

Thanks,

Stephan

(1) Reply
ChrisG
By Community Manager Community Manager
Community Manager

That's a really interesting question. I've not seen a lot of consistency or clear trends in how organizations are gathering and tracking details about software that is running containers, and would also love to hear more stories of how people are doing it (or are considering doing it)!

I don't believe Data Platform models containers with any precision currently. You may want to consider adding an idea in the Flexera Ideas part of Community to improve this situation.

Another Flexera product - FlexNet Manager Suite - provides some capabilities around gathering inventory of software that is installed in container images found on computers, and then exposing that information for reporting and analysis. Here are a couple of posts that talk about how this:

 

(Did my reply solve the question? Click "ACCEPT AS SOLUTION" to help others find answers faster. Liked something? Click "KUDO". Anything expressed here is my own view and not necessarily that of my employer, Flexera.)