Some users may have issues creating a community account See more here.

More about Linux Docker container support in FlexNet Manager Suite 2020 R1

tferguson
Flexera
Flexera
9 0 1,739

A Docker container image is a package of all the scripts, software, runtime, system tools, libraries, and configuration required to run an application.  A container image can be launched as a Docker container in a lightweight isolated environment using the Docker Engine.  Like virtual machines, containers isolate resources.  However, while virtual machines abstract hardware and run individual operating system kernels, containers make it possible to run multiple isolated applications on a single operating system kernel instance.  Therefore, containers eliminate the weight of a hypervisor by executing directly on the Linux or Windows kernel. 

A comparison of virtualization and ContainerizationA comparison of virtualization and Containerization

 The simplicity of deployment, portability to any system, repeatability, efficient execution, and isolation is making container technology extremely popular in the enterprise.  The concept of containerization was not new with Linux.  AIX Workload Partitions (wPAR) and Solaris Zones have come before.  However, Docker has provided a far more complete ecosystem. 

Support for gathering inventory of Docker containers and inventory of the container images running on Linux has been introduced in the recent FlexNet Manager Suite 2020 R1 release.  In this initial phase, our aim (as described in a previous blog post Discovery and Inventory of Docker Containers in FlexNet Manager Suite 2020 R1is to provide visibility of running containers, the container images, and the recognized software within these images. 

This new capability has introduced a new component to the Linux FlexNet inventory agent: Flexera’s Docker tracker.  Docker tracker is responsible for monitoring the Docker Engine to discover containers as they start and stop.  Further to this, it is responsible for gathering raw evidence from container images. 

In the initial path chosen for inventorying Docker container images, Docker tracker waits for a container executing the image to be launched and performs a zero-footprint inventory on the executing container – in other words, there is no need for particular software to be pre-installed or specially configured inside the container.  The inventory gathering process involves the following steps: 

  1. Copy the lightweight inventory scanner, ndtrack.sh, into the container’s file system  
  2. Use the Docker Engine to execute ndtrack.sh within the container to gather inventory for the container’s image 
  3. Copy the resulting ndi inventory file out of the container into the inventory agent “upload” folder on the Docker host  
  4. Upload the ndi inventory files generated for both the container images and the host to the FlexNet Manager servers.  

This is illustrated in the following diagram: 

FlexNet inventory of Docker container imagesFlexNet inventory of Docker container images

By performing a zero-footprint inventory, the full capability of the FlexNet inventory agent is used to gather all types of raw installation evidence from each container image. 

To present the information obtained by the agent, several new UI elements have been introduced into FlexNet Manager.  The Discovery & Inventory > All Containers view displays information about all the container hosts, the Docker images on those hosts, and the containers created using those Docker images:

1.png

From here, a user can drill down into a container image’s properties:2.png

These image properties include a list of all the applications identified by the Application Recognition Library (ARL) from software evidence gathered from the image:3.png

Another tab highlights the evidence used to identify those applications.  It is worth noting in this example that it includes not just the RPM evidence of the containerized Linux operating system, but also the custom Oracle Universal Installer (OUI) technology used to install many Oracle applications.  This evidence, amongst others, is specifically identified and reported by the FlexNet inventory agent.4.png

It is also possible to open an inventory device’s properties and see all the Docker containers running on that device.5.png

This is an initial capability for working with containers.  As always, there is still more work that can be done.  Let us know in comments on this post about what additional capabilities you’d like to see – some potential capabilities under consideration include:

  • Support for Windows Docker containers
  • Gathering inventory from container management infrastructure such as Kubernetes
  • Static analysis of container images without the need to run images
  • Consider software running within containers when calculating license consumption

We hope you enjoy this early Docker container support and we look forward to your feedback!