Fine grained container security

A method for a containerized application, comprising:

• receiving an indication of a request from a user to create a containerized application, wherein the indication comprises a first user authentication information and an application permission information for the containerized application, wherein the first user authentication information comprises an authentication token issued by an authentication server for the user request upon an initial user login into the system;
• determining, using a processor, whether the first user authentication information indicates that the user has permission to create a definition for the containerized application with the application permission information;
• in the event that the first user authentication information indicates the user has permission to execute the containerized application with the application permission information, creating the definition for the containerized application, which can be used to execute the containerized application in a container, with the application permission information;
• determining whether a second user authentication information indicates that the user has permission to execute the containerized application using the definition for the containerized application, wherein determining whether the second user authentication information indicates that the user has permission to execute the containerized application using the definition for the containerized application is based at least in part on the application permission information associated with the containerized application;
• and
• in the event the second user authentication information indicates that the user has permission to execute the containerized application, indicating to process a job by executing the containerized application in the container.

A computer program product embodied in a non-transitory computer readable storage medium for a containerized application comprising computer instructions when executed to perform functions of:

• receiving an indication of a request from a user to create a containerized application, wherein the indication comprises a first user authentication information and an application permission information for the containerized application, wherein the first user authentication information comprises an authentication token issued by an authentication server for the user request upon an initial user login into the system;
• determining whether the first user authentication information indicates that the user has permission to create a definition for the containerized application with the application permission information;
• in the event that the first user authentication information indicates the user has permission to execute the containerized application with the application permission information, creating the definition for the containerized application, which can be used to execute the containerized application in a container, with the application permission information;
• determining whether a second user authentication information indicates that the user has permission to execute the containerized application using the definition for the containerized application, wherein determining whether the second user authentication information indicates that the user has permission to execute the containerized application using the definition for the containerized application is based at least in part on the application permission information associated with the containerized application;
• and
• in the event the second user authentication information indicates that the user has permission to execute the containerized application, indicating to process a job by executing the containerized application in the container.