Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

What is Grafeas? Better auditing for containers

Serdar Yegulalp | Oct. 16, 2017
Google's Grafeas provides a common API for metadata about containers, from image and build details to security vulnerabilities

What is Grafeas? Better auditing for containers
Credit: Thinkstock

The software we run has never been more difficult to vouchsafe than it is today. It is scattered between local deployments and cloud services, built with open source components that aren’t always a known quantity, and delivered on a fast-moving schedule, making it a challenge to guarantee safety or quality.

The end result is software that is hard to audit, reason about, secure, and manage. It is difficult not just to know what a VM or container was built with, but what has been added or removed or changed and by whom. Grafeas, originally devised by Google, is intended to make these questions easier to answer.

 

What is Grafeas?

Grafeas is an open source project that defines a metadata API for software components. It is meant to provide a uniform metadata schema that allows VMs, containers, JAR files, and other software artifacts to describe themselves to the environments they run in and to the users that manage them. The goal is to allow processes like auditing the software used in a given environment, and auditing the changes made to that software, to be done in a consistent and reliable way.

Grafeas provides APIs for two kinds of metadata, notes and occurrences:

  • Notes are details about some aspect of the software artifact in question. This can be a description of a known software vulnerability, details about how the software was built (the builder version, its checksum, etc.), a history of its deployment, and so on.
  • Occurrences are instances of notes, with details about where and how they were created. Details of a known software vulnerability, for instance, could have occurrence information describing which vulnerability scanner detected it, when it was detected, and whether or not the vulnerability has been addressed.

Both notes and occurrences are stored in a repository. Each note and occurrence is  tracked using an identifier that distinguishes it and makes it unique.

The Grafeas spec includes several basic schemas for types of notes. The package vulnerability schema, for instance, describes how to store note information for a CVE or vulnerability description. Right now there is no formal process for accepting new schema types, but plans are on the table for creating such a process.

 

Grafeas clients and third-party support

Right now, Grafeas exists mainly as a spec and a reference implementation, available on GitHub. Clients for Go, Python, and Java are all available, generated by Swagger, so clients for other languages shouldn’t be hard to produce.

 

1  2  Next Page 

Sign up for Computerworld eNewsletters.