Infrastructure-agnostic network-level visibility and policy enforcement for containers

A non-transitory computer-readable storage medium storing instructions for enforcing a segmentation policy, the instructions when executed by a processor causing the processor to perform steps including:

• executing a container on a host operating system of a processing device, wherein host processes of the host operating system are associated with a host namespace and the container is associated with a container namespace;
• obtaining, by a configuration generation module executing in the host namespace of the host operating system, management instructions for controlling communications to and from the container;
• configuring, by the configuration generation module, a traffic control and monitoring module executing within the container namespace to carry out the management instructions;
• and
• operating the traffic control and monitoring module executing within the container namespace to block communications to and from the container that are not permitted by the management instructions and to permit communications to and from the container that are permitted by the management instructions.

A computing device for enforcing a segmentation policy, the computing device comprising:

• one or more processors;
• and
• a non-transitory computer-readable storage medium storing instructions that when executed by the one or more processors cause the one or more processors to perform steps including:
• executing a container on a host operating system of a processing device wherein host processes of the host operating system are associated with a host namespace and the container is associated with a container namespace;
• obtaining, by a configuration generation module executing in the host namespace of the host operating system, management instructions for controlling communications to and from the container;
• configuring, by the configuration generation module, a traffic control and monitoring module executing within the container namespace to carry out the management instructions;
• and
• operating the traffic control and monitoring module executing within the container namespace to block communications to and from the container that are not permitted by the management instructions and to permit communications to and from the container that are permitted by the management instructions.