Automatic deployment of application security policy using application manifest and dynamic process analysis in a containerization environment

A computer container system comprising:

• one or more application containers, each application container including computer-readable instructions and initiated via a container service and isolated using operating system-level virtualization;
• a computing device comprising memory and a processor, the memory configured to store code instructions, the code instructions, when executed by the processor, cause the processor to:
• detect that an application container of the one or more application containers has been added in the container system;
• open a stored manifest for the application container, the stored manifest comprising configuration settings for the newly added application container, wherein the stored manifest for the application data further comprises information indicating an image file in which executable code for the application container is stored, incoming and outgoing ports for the application container, services to which the application container connects, and user credentials to access the services;
• retrieve running services information regarding the application container, the running services information including information provided by the container service about the application container running on the container system;
• and
• generate a security policy for the application container, the security policy defining a set of actions for which the application container can perform, the set of actions determined using the manifest and the running service information associated with the application container;
• a security container operating to load the security policy, the security container configured to block an action performed by the application container in response to determining that the action performed by the application container does not match any action in the set of actions defined in the security policy for the application container;
• and
• a graphical user interface container operating to present information about the generated security policy to a user via a display device.

A non-transitory computer storage readable medium comprising stored instructions, the instructions when executed by a processor, causes the processor to:

• detect that an application container has been added in the container system, the application container including computer-readable instructions, the application container able to be initiated via a container service and isolated using operating system-level virtualization;
• open a stored manifest for the application container, the stored manifest comprising configuration settings for the newly added application container, wherein the stored manifest for the application data further comprises information indicating an image file in which executable code for the application container is stored, incoming and outgoing ports for the application container, services to which the application container connects, and user credentials to access the services;
• retrieve running services information regarding the application container, the running services information including information provided by the container service about the application container running on the container system;
• generate a security policy for the application container, the security policy defining a set of actions for which the application container can perform, the set of actions determined using the manifest and the running service information associated with the application container;
• load the security policy at a security container, the security container configured to, upon loading the security policy, block an action performed by the application container in response to determining that the action performed by the application container does not match any action in the set of actions defined in the security policy for the application container;
• and
• transmit the security policy to a graphical user interface container for presentation to a user via a display device, the graphical user interface container presenting information about the generated security policy.

A computer-implemented method in a container system, comprising:

• detecting that an application container has been added in the container system, the application container having computer-readable instructions, the application container initiated via a container service and isolated using operating system-level virtualization;
• opening a stored manifest for the application container, the stored manifest comprising configuration settings for the newly added application container;
• retrieving running services information regarding the application container, the running services information including information provided by the container service about the application container running on the container system, wherein retrieving the running services information regarding the application container further comprises executing a command line interface instruction to cause the container service to request a list of service descriptors for a namespace comprising the application container;
• generating a security policy for the application container, the security policy defining a set of actions for which the application container can perform, the set of actions determined using the manifest and the running service information associated with the application container;
• loading the security policy at a security container, the security container configured to, upon loading the security policy, block an action performed by the application container in response to determining that the action performed by the application container does not match any action in the set of actions defined in the security policy for the application container;
• and
• transmitting the security policy to a graphical user interface container for presentation to a user via a display device, the graphical user interface container presenting information about the generated security policy.

A computer container system comprising:

• one or more application containers, each application container including computer-readable instructions and initiated via a container service and isolated using operating system-level virtualization;
• a computing device comprising memory and a processor, the memory configured to store code instructions, the code instructions, when executed by the processor, cause the processor to:
• detect that an application container of the one or more application containers has been added in the container system;
• open a stored manifest for the application container, the stored manifest comprising configuration settings for the newly added application container;
• retrieve running services information regarding the application container, the running services information including information provided by the container service about the application container running on the container system, wherein the instruction to retrieve the running services information regarding the application container further comprises an instruction to execute a command line interface instruction to cause the container service to request a list of service descriptors for a namespace comprising the application container;
• and
• generate a security policy for the application container, the security policy defining a set of actions for which the application container can perform, the set of actions determined using the manifest and the running service information associated with the application container;
• a security container operating to load the security policy, the security container configured to block an action performed by the application container in response to determining that the action performed by the application container does not match any action in the set of actions defined in the security policy for the application container;
• and
• a graphical user interface container operating to present information about the generated security policy to a user via a display device.

A non-transitory computer storage readable medium comprising stored instructions, the instructions when executed by a processor, causes the processor to:

• detect that an application container has been added in the container system, the application container including computer-readable instructions, the application container able to be initiated via a container service and isolated using operating system-level virtualization;
• open a stored manifest for the application container, the manifest comprising configuration settings for the newly added application container;
• retrieve running services information regarding the application container, the running services information including information provided by the container service about the application container running on the container system, wherein the instruction to retrieve the running services information regarding the application container further comprises an instruction to execute a command line interface instruction to cause the container service to request a list of service descriptors for a namespace comprising the application container;
• and
• generate a security policy for the application container, the security policy defining a set of actions for which the application container can perform, the set of actions determined using the manifest and the running service information associated with the application container;
• load the security policy at a security container, the security container configured to, upon loading the security policy, block an action performed by the application container in response to determining that the action performed by the application container does not match any action in the set of actions defined in the security policy for the application container;
• and
• transmit the security policy to a graphical user interface container for presentation to a user via a display device, the graphical user interface container presenting information about the generated security policy.