System and method for monitoring file integrity of multiple containers using one agent

A method for monitoring file integrity of a plurality of containers in a host computing device, the method comprising:

• providing an agent in the host computing device external to the containers and a policy file configuring policy for the containers;
• intercepting, by the agent, a first system call of one of the containers, the first system call indicating mounting of a container file path onto a corresponding host file path;
• constructing, by the agent, a first correspondence between the container file path and the host file path based on the first system call;
• intercepting, by the agent, a second system call of the one of the containers, the second system call indicating opening of the policy file, the policy file containing the container file path and violation corresponding to the container file path, and the violation indicating action(s) that would break file integrity;
• constructing, by the agent, a second correspondence between the container file path and the violation based on the second system call;
• aggregating, by the agent, the first correspondence and the second correspondence to obtain the third correspondence between the host file path and the violation of the container;
• and
• monitoring, by the agent, file integrity of the container by detecting violation of the host file path in the third correspondence.

A non-transitory computer readable medium storing computer executable code, wherein the computer executable code, when executed at a processor of a computing device, is configured to:

• provide a plurality of containers, an agent external to the containers, and a policy file configuring policy for the containers;
• intercept, by the agent, a first system call of one of the containers, the first system call indicating mounting of a container file path onto a corresponding host file path;
• construct, by the agent, a first correspondence between the container file path and the host file path based on the first system call;
• intercept, by the agent, a second system call of the one of the containers, the second system call indicating opening of the policy file, the policy file containing the container file path and violation corresponding to the container file path, and the violation indicating action(s) that would break file integrity;
• construct, by the agent, a second correspondence between the container file path and the violation based on the second system call;
• aggregate, by the agent, the first correspondence and the second correspondence to obtain the third correspondence between the host file path and the violation of the container;
• and
• monitor, by the agent, file integrity of the container by detecting violation of the host file path in the third correspondence.