System call policies for containers

A non-transitory computer-readable storage medium comprising instructions that when executed cause a system to:

• identify metadata of a container running an application, wherein the metadata includes an application type of the application;
• determine a policy for the container from a data structure based on the application type in the metadata of the container, wherein the data structure maps permissions for system calls to application types and classifies the system calls into a set of system call categories, and wherein the policy comprises a first relationship specifying that the application type is prohibited from performing a first system call category of the set of system call categories, and a second relationship specifying that the application type is permitted to perform a given system call within the first system call category, the second relationship in the policy overriding the first relationship;
• apply the policy to allow or deny the application permission to perform a system call within the first system call category based on a comparison of the system call to the policy, wherein the policy specifies that the system call is permitted to be performed a non-zero number of times, wherein the container is part of a plurality of containers running respective applications of different application types;
• initialize different counters in runtime environments of corresponding containers of the plurality of containers, the different counters for tracking non-zero numbers of times that system calls are permitted to be performed by the applications of the different application types running in the corresponding containers of the plurality of containers;
• and
• responsive to the system call, check the counter in the runtime environment of the container to determine whether the system call is permitted to be performed.

A computing system comprising:

• a processor;
• and
• a non-transitory computer-readable storage medium storing instructions executable on the processor to:
• provide a plurality of containers for running respective types of applications, wherein each respective container of the plurality of containers has a metadata record that specifies an application type of an application that is run in the respective container;
• initialize different counters associated with corresponding containers of the plurality of containers, the different counters for tracking non-zero numbers of times that system calls are permitted to be performed by the applications of the different application types running in the corresponding containers of the plurality of containers;
• in response to a system call from an application in a first container of the plurality of containers, determine a policy to apply to the first container based on a first application type in the metadata record of the first container;
• and
• implement the policy for the first container and check a first counter associated with the first container, to permit the first container and the application running in the first container to perform the system call.