Container application security and protection

An apparatus comprising:

• one or more processors configured to execute a plurality of pages of code in a plurality of user spaces via a container host operating system of a container host platform, wherein each of the plurality of pages of code comprises a portion of code executable via the container host operating system, wherein the plurality of pages of code comprise pages of code from a plurality of container applications configured to utilize the container host operating system, and wherein at least one of the one or more processors is configured to:
• execute the container host operating system;
• monitor, from outside the container host operating system, the plurality of pages of code executing via the container host operating system in the plurality of user spaces;
• determine, from outside the container host operating system, that a first page of code of the plurality of pages of code violates a security policy configured to apply security within the container host platform;
• identify, from outside the container host operating system, a container application of the plurality of container applications that is a source of the first page of code of the plurality of pages of code by querying a container daemon of the container host platform for a container identifier associated with the first page of code by generating at least one second page of code to execute via the container host operating system to determine the container application;
• and
• apply the security policy to the container application of the plurality of container applications in response to identifying the container application as the source of the first page of code.

A tangible, non-transitory computer readable storage media encoded with instructions, wherein the instructions, when executed, are operable to:

• execute, via one or more processors, a container host operating system of a container host platform;
• monitor, by the one or more processors from outside the container host operating system, a plurality of pages of code executing via the container host operating system, wherein the plurality of pages of code comprise pages of code from a plurality of container applications configured to utilize the container host operating system, and wherein each of the plurality of pages of code comprises a portion of code executable via the container host operating system of the container host platform;
• determine, by the one or more processors from outside the container host operating system, that a first page of code of the plurality of pages of code violates a security policy configured to apply security within the container host platform;
• identify, by the one or more processors from outside the container host operating system, a container application of the plurality of container applications that is a source of the first page of code of the plurality of pages of code by querying a container daemon of the container host platform for a container identifier associated with the first page of code by generating at least one second page of code to execute via the container host operating system to determine the container application;
• and
• apply the security policy to the container application of the plurality of container applications in response to identifying the container application of the plurality of container applications as the source of the first page of code.