Enforcing security policies for software containers

A system comprising:

• at least one memory;
• at least one processor in communication with the at least one memory, the at least one processor configured to obtain instructions from the memory that cause the at least one processor to perform a method comprising:
• comparing, in response to an attempt to install an instance of a container image in a production environment, a set of security criteria associated with the container image and features of the production environment, wherein the container instance comprises a run-time entity that is configured to utilize referenced components of the container image while executing upon on operating system kernel of the production environment, wherein the comparing the set of security criteria associated with the container image and the features of the production environment comprises comparing the set of security criteria to a pre-established map of the security functionalities of the production environment, wherein the pre-established map is created based on an audit of the features of the production environment, and wherein the comparing the set of security criteria to the pre-established map of the security functionalities of the production environment comprises:
• generating, based on the audit, a listing of the features of the production environment;
• and
• enumerating, for each particular security criterion of the set of security criteria, correlations between the particular security criterion and corresponding particular listed features that satisfy that particular security criterion;
• and
• determining, based on the comparing, whether the features of the production environment satisfy the set of security criteria.

A computer program product comprising a computer readable storage medium, wherein the computer readable storage medium is not a transitory signal per se, the computer readable storage medium having program instructions embodied therewith, the programs instructions configured, when executed by at least one computer, to cause the at least one computer to perform a method comprising:

• comparing, in response to an attempt to install an instance of a container image in a production environment, a set of security criteria associated with the container image and features of the production environment, wherein the container instance comprises a run-time entity that is configured to utilize referenced components of the container image while executing upon on operating system kernel of the production environment, wherein the attempt to install the container instance includes obtaining the container image from a container registry that includes a plurality of different container images, wherein the container image as received at the container registry includes an associated security prerequisite file that includes the set of security criteria, wherein the comparing the set of security criteria associated with the container image and the features of the production environment comprises comparing the set of security criteria to a pre-established map of the security functionalities of the production environment, and wherein the pre-established map is created based on an audit of the features of the production environment;
• determining, based on the comparing the set of security criteria associated with the container image and the features of the production environment, whether the features of the production environment satisfy the set of security criteria;
• determining that the features of the production environment do not satisfy at least one criterion of the set of security criteria;
• identifying, based on an identity of the not satisfied at least one criterion, a risk associated with the installation of the container instance;
• providing an added security feature to the production environment to alleviate the identified risk;
• and
• allowing, based on the added security feature, the attempted installation to be completed.