Runtime non-intrusive container security introspection and remediation

A method of detecting security threats in executing containers, the method comprising:

• creating, a first snapshot of an upper system layer of a persistent storage associated with a container, wherein the persistent storage includes a lower system layer, which is write protected, and the upper system layer;
• detecting, a first request by the container to modify data in the first persistent storage;
• forwarding, a first requested modification to a security inspection service;
• determining, a threat state of the container based on the first requested modification, wherein the threat state is one of a threatening state and a non-threatening state;
• and
• responsive to determining that the container is in the non-threatening state:
• notifying the container that the first requested modification is non-threatening;
• and
• creating, a second snapshot of the upper system layer;
• and
• responsive to determining that the container is in the threatening state, instructing a container engine to respond to the threatening state, wherein a threat level of the container in the threatening state is one of low, medium, and high, and wherein the container engine responds to a container in the low threat level threatening state by allowing the first requested modifications to be retained, and by migrating the container to a second memory including migrating the first persistent storage to a second persistent storage in the second memory.

A computer-readable non-transitory storage medium storing executable instructions of detecting security threats in executing containers, which when executed by a computer system, cause the computer system to:

• create, a first snapshot of an upper system layer of a persistent storage associated with a container, wherein the persistent storage includes a lower system layer, which is write protected, and the upper system layer;
• detect, a first request by the container to modify data in the first persistent storage;
• forward, a first requested modification to a security inspection service;
• receive, by the container, prior to a security inspection service determining a threat state of the container based on the first requested modification, a second request associated with a second requested modification, and a third request associated with a third requested modification;
• and
• combine the second requested modification and the third requested modification into a fourth requested modification to forward to the security inspection service to determine the threat state of the container based on the fourth requested modification, wherein the second requested modification and the third requested modification are combined into the fourth requested modification based on at least one of (i) a watcher service awaiting a notification that the first requested modification is non-threatening, (ii) a threshold time between forwarded requested modifications from the watcher service to the security inspection service, and (iii) an update time window to capture potentially related requested modifications;
• determine, the threat state of the container based on the first requested modification, wherein the threat state is one of a threatening state and a non-threatening state;
• and
• responsive to determining that the container is in the non-threatening state:
• notifying the container that the first requested modification is non-threatening;
• and
• creating, a second snapshot of the upper system layer;
• and
• responsive to determining that the container is in the threatening state, instructing a container engine to respond to the threatening state.