Abstract: A container-based software implementation uses separate containers for software libraries and application code. A storage system may have multiple applications executing to control various aspects of operation of the storage system, and to enable access to the storage system by hosts. These applications are containerized separately from the libraries referenced by the applications, and the libraries are commonly housed in a separate container. The libraries may be open-source libraries, proprietary libraries, or third-party dependent libraries. A vulnerability management system scans the application containers to determine dependencies between applications and libraries, including the number of containers that reference a particular library and the frequency with which microservices of the containerized application reference the library.

Abstract: A container-based software implementation uses separate containers for software libraries and application code. A storage system may have multiple applications executing to control various aspects of operation of the storage system, and to enable access to the storage system by hosts. These applications are containerized separately from the libraries referenced by the applications, and the libraries are commonly housed in a separate container. The libraries may be open-source libraries, proprietary libraries, or third-party dependent libraries. A vulnerability management system scans the application containers to determine dependencies between applications and libraries, including the number of containers that reference a particular library and the frequency with which microservices of the containerized application reference the library.

Abstract: A boot image is modified to require authentication based on stable system values that are uniquely associated with a storage array. The stable system values may be used as a key to decrypt a password. The modified boot image will not allow booting to proceed without the decrypted password. The password cannot be decrypted based on different stable system values such as the stable system values of other storage arrays.

Abstract: A workload manager uses on-band and off-band metrics to select a host server in a cluster to handle a connection request. The on-band metrics include CPU usage, memory usage, and vulnerability metrics. The off-band metrics include hardware component error logs. Utilization and vulnerability scores are calculated for each host server from the on-band metrics. A reliability score is calculated for each host server from the off-band metrics. A health score for each host server is calculated from the vulnerability and reliability scores. The health score is used to exclude unhealthy host servers from consideration. A priority score is calculated for each host server from the utilization, vulnerability, and reliability scores. The host server that has not been excluded and has the greatest priority score is selected to handle the connection request.

Abstract: An apparatus comprises at least one processing device coupled to memory. The at least one processing device is configured to obtain a secured disk image comprising an encrypted manifest file, an encrypted install binary and a plurality of other files. The at least one processing device is further configured to obtain a certificate corresponding to the secured disk image and to derive a public key based at least in part on the certificate. The at least one processing device is further configured to decrypt the manifest file and the install binary based at least in part on the public key and to validate checksums for respective ones of the plurality of other files against corresponding checksums contained in the decrypted manifest file. The at least one processing device is further configured to execute the decrypted install binary responsive to validation of the checksums for the respective ones of the plurality of other files.

Abstract: A workload manager uses on-band and off-band metrics to select a host server in a cluster to handle a connection request. The on-band metrics include CPU usage, memory usage, and vulnerability metrics. The off-band metrics include hardware component error logs. Utilization and vulnerability scores are calculated for each host server from the on-band metrics. A reliability score is calculated for each host server from the off-band metrics. A health score for each host server is calculated from the vulnerability and reliability scores. The health score is used to exclude unhealthy host servers from consideration. A priority score is calculated for each host server from the utilization, vulnerability, and reliability scores. The host server that has not been excluded and has the greatest priority score is selected to handle the connection request.

Abstract: An apparatus comprises at least one processing device coupled to memory. The at least one processing device is configured to obtain a secured disk image comprising an encrypted manifest file, an encrypted install binary and a plurality of other files. The at least one processing device is further configured to obtain a certificate corresponding to the secured disk image and to derive a public key based at least in part on the certificate. The at least one processing device is further configured to decrypt the manifest file and the install binary based at least in part on the public key and to validate checksums for respective ones of the plurality of other files against corresponding checksums contained in the decrypted manifest file. The at least one processing device is further configured to execute the decrypted install binary responsive to validation of the checksums for the respective ones of the plurality of other files.

Abstract: A boot image is modified to require authentication based on stable system values that are uniquely associated with a storage array. The stable system values may be used as a key to decrypt a password. The modified boot image will not allow booting to proceed without the decrypted password. The password cannot be decrypted based on different stable system values such as the stable system values of other storage arrays.