Images

An Image in Klarity ImageFactory is the final artifact produced by a successful template build. It represents a specific, versioned instance of your golden image, ready for deployment in your cloud environment. Each image is accompanied by a wealth of metadata, including build logs, security reports, and distribution details.

Images are the tangible output of the ImageFactory pipeline, providing a secure and verified foundation for your virtual machine infrastructure.

Image Properties

Every image record in ImageFactory contains several key attributes that define its state and characteristics.

• Name: The name of the image, often derived from the template name and a timestamp.
• Provider: The cloud platform where the image was created.
• State: The current lifecycle status of the image.
• Details: A comprehensive object containing build-time information and results.
• Metadata: Additional key-value pairs associated with the image.
• Compound Key: Internally, images are identified by a combination of the template_id and the image_id.

Image States

The state of an image reflects its current status within the platform and the target cloud environment.

• PENDING: The build process is currently underway.
• CREATED: The image has been successfully built, tested, and distributed.
• DELETED: The image has been removed from ImageFactory and the target cloud accounts.
• ERROR: A failure occurred during the build or test phase.
• SHARE_ERROR: The image was built successfully, but an error occurred while sharing it with other cloud accounts.
• DELETE_ERROR: An error occurred while attempting to delete the image from the cloud provider.

Build Details and Artifacts

When a build completes, ImageFactory aggregates a wide range of information about the process and the resulting artifact.

Build Configuration

The image record stores the exact versions of the build_components and test_components used during the build. It also includes the tags applied to the image and a change_log summarizing the modifications made.

Compliance and Reporting

Security and compliance are central to the ImageFactory value proposition. Every image includes:

• Compliance Score: A numerical value representing the image's adherence to security standards.
• Compliance Reports: Both JSON and PDF versions of the detailed security scan results, available for download from the UI or API.
• Package Inventory: A complete list of all software packages installed on the image.
• SBOM (Software Bill of Materials): A machine-readable inventory of all components, libraries, and dependencies, helping organizations manage supply chain security.

Technical Metadata

• Result Image ID: The native identifier for the image in the cloud provider (e.g., an AMI ID in AWS).
• Result Image URI: A provider-specific URI for the image.
• Build Time: The total duration of the build process in seconds, along with detailed timing for each stage.
• Source Image: Information about the base distribution image used as the starting point.

Cloud Distributions

ImageFactory tracks the distribution of the image across multiple cloud accounts. The cloud_distributions object provides a per-account breakdown of the results.

Field	Description
Account ID	The internal ImageFactory ID for the target cloud account.
Cloud Provider ID	The native ID of the target account (e.g., AWS Account ID).
Result Image ID	The ID of the image as it appears in the target account.
Errors	Any error messages encountered during the distribution process.
Deletion Status	Whether the image has been successfully removed from this specific account.

SBOM Generation

The Software Bill of Materials (SBOM) is a critical artifact for modern security compliance. ImageFactory automatically generates an SBOM for every image it builds. This document provides a transparent view of the software supply chain, allowing security teams to quickly identify if a specific vulnerability (CVE) affects their golden images.

The SBOM is generated in SPDX 2.3 JSON format, ensuring it can be integrated with other security and asset management tools.

Managing Image Lifecycle

Images produced by ImageFactory are subject to lifecycle management policies defined in the template.

1. Retention: The imageRetainCount setting in the template determines how many previous versions of an image are kept. When a new build succeeds, ImageFactory automatically identifies and deletes the oldest images that exceed this count.
2. Manual Deletion: Users can manually delete images through the UI or API. This triggers a cleanup process that removes the image from all distributed cloud accounts.
3. Reporting Access: Compliance reports and inventories are stored securely. ImageFactory provides temporary download URLs to allow authorized users to download these reports directly from the UI or API.

By providing a detailed and transparent record of every image build, ImageFactory enables organizations to maintain a high level of trust in their cloud infrastructure.