Correspondence of external operations to containers and mutation events

A computer program product for determining, command-to-process correspondence, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:

• identifying, by a hardware processor of the computer, initial processes resulting from executions of container immutability change events for each of multiple initially mutable containers in a cluster, based on an execution time, a process identifier and a process group identifier for each of the container immutability change events;
• checking, by the hardware processor, if an initial process from among the identified initial processes matches an entry in a database that stores external container commands and at least one respective process resulting from executing each of the external container commands;
• and
• designating, by the hardware processor, a particular external command, from among the external container commands stored in the database, as having a correspondence to the initial process, responsive to the initial process matching the at least one respective process resulting from executing the particular external command.

A compute processing system for determining command-to-process correspondence, comprising:

• a memory device including program code stored thereon;
• a hardware processor, operatively coupled to the memory device, and configured to run the program code stored on the memory device to
• identify initial processes resulting from executions of container immutability change events for each of multiple initially mutable containers in a cluster, based on an execution time, a process identifier and a process group identifier for each of the container immutability change events;
• check if an initial process from among the identified initial processes matches an entry in a database that stores external container commands and at least one respective process resulting from executing each of the external container commands;
• and
• designate a particular external command, from among the external container commands stored in the database, as having a correspondence to the initial process, responsive to the initial process matching the at least one respective process resulting from executing the particular external command.