Containerized Applications and Data Platform

[stephanhh]

Hi community members,

we are considering to discover the software installed within Docker containers and implement an additional normalize schedule. Here we face some challenges and we are wondering if anyone from the community has additional ideas how to tackle them.

• Container and container images
  Since the container instances are deployed and shut down on demand we'd rather focus on the container images as a source for software inventory information. Incorporating every (probably short-lived) container instance into our software inventory doesn't seem to make much sense to us: all instances stemming from the same instance are more or less identical and share the same content. However, data platform cannot properly display the images  because it sticks to the concept of a host computer. We might handle container images as special hosts but are not sure if that works out in the end.
  Or shall we better manage the individual container instances?  Here we might run into deduping issues if multiple similar containers run on the same host.
• Inventory
  The software within the container images will be deployed by various ways. In some cases even preconfigured contaier images (i.e. from dockerhub) might be used. So we don't have real control on how the installations are made, e.g. add/remove software entries don't really exist.
  We think we have to incorporate a full software scan of the container images to get the full picture. Fortunately enough we've already got an analysis software in place (JFrog XRay) which scans the containers for vulnerabilities and license compliance issues. It lokks as if  this software can also produce a list of all software found in the container image. This list could in turn be imported into data platform. 
  But will data platform properly recognize the data? We don't really want to enter every software into the private catalog.
  Has anyone done that already and could share her/his experiences?   

Any other ideas? Any other input?

Thanks,

Stephan

[ChrisG]

That's a really interesting question. I've not seen a lot of consistency or clear trends in how organizations are gathering and tracking details about software that is running containers, and would also love to hear more stories of how people are doing it (or are considering doing it)!

I don't believe Data Platform models containers with any precision currently. You may want to consider adding an idea in the Flexera Ideas part of Community to improve this situation.

Another Flexera product - FlexNet Manager Suite - provides some capabilities around gathering inventory of software that is installed in container images found on computers, and then exposing that information for reporting and analysis. Here are a couple of posts that talk about how this:

• Discovery and Inventory of Docker Containers in Flexnet Manager Suite 2020 R1
• More about Linux Docker container support in FlexNet Manager Suite 2020 R1