Storage system for network information

A method comprising:

• storing, by a host computer system comprising a physical interface and an operating system, a plurality of containers for a plurality of tenants, wherein the plurality of containers includes a first container that includes a first database executable to store network event information for a first tenant of the plurality of tenants, and wherein the plurality of containers includes a second container that includes a second database executable to store network event information for a second tenant of the plurality of tenants;
• assigning, by the host computer system, processes of the operating system to a root network group, wherein assignment to the root network group permits the processes of the operating system to access the physical interface of the host computer system and to access network stack information maintained by the operating system;
• assigning, by the host computer system, the first database of the first container to a first container network group associated with a set of restrictions, wherein assignment of the first database of the first container to the first container network group isolates the network event information for the second tenant of the second database of the second container from the first container by restricting, based on the set of restrictions associated with the first container network group, the first database from accessing the physical interface of the host computer system, the network stack information maintained by the operating system, and network stack information maintained by the second container;
• and
• assigning, by the host computer system, the second database of the second container to a second container network group associated with a set of restrictions, wherein assignment of the second database of the second container to the second container network group isolates the network event information of the first tenant of the first database of the first container from the second container by restricting, based on the set of restrictions associated with the second container network group, the second database from accessing the physical interface of the host computer system, the network stack information maintained by the operating system, and network stack information maintained by the first container.

A non-transitory computer readable medium storing instructions that, when executed by a processor of a host computer system comprising a physical interface and an operating system, causes the processor to perform operations comprising:

• storing a plurality of containers for a plurality of tenants, wherein the plurality of containers includes a first container that includes a first database executable to store network event information for a first tenant of the plurality of tenants, and wherein the plurality of containers includes a second container that includes a second database executable to store network event information for a second tenant of the plurality of tenants;
• assigning processes of the operating system to a root network group, wherein assignment to the root network group permits the processes of the operating system to access the physical interface of the host computer system and to access network stack information maintained by the operating system;
• assigning the first database of the first container to a first container network group associated with a set of restrictions, wherein assignment of the first database of the first container to the first container network group isolates the network event information for the second tenant of the second database of the second container from the first container by restricting, based on the set of restrictions associated with the first container network group, the first database from accessing the physical interface of the host computer system, the network stack information maintained by the operating system, and network stack information maintained by the second container;
• and
• assigning the second database of the second container to a second container network group associated with a set of restrictions, wherein assignment of the second database of the second container to the second container network group isolates the network event information for the first tenant of the first database of the first container from the second container by restricting, based on the set of restrictions associated with the second container network group, the second database from accessing the physical interface of the host computer system, the network stack information maintained by the operating system, and network stack information maintained by the first container.