Incident response for containers and serverless functions

A non-transitory computer-readable medium comprising instructions that, when executed by one or more processors of a first entity, cause the one or more processors of the first entity to:

• host a first container comprising an execution of a first image;
• receive a request to access the first container;
• provide access to the first container;
• send an alert regarding the request to access the first container to a computing device of a second entity that has access to the first container, wherein the second entity is different than the first entity;
• receive an indication, from the computing device of the second entity and after sending the alert, that the request to access the first container is a potential security threat;
• and
• in response to receiving the indication:
• generate a second image comprising a copy of the first image;
• and
• switch from providing access to the first container to providing access to a second container comprising an execution of the second image.

A method, comprising:

• hosting, via one or more processors of a first entity, a first container comprising an execution of a first image;
• receiving, via the one or more processors, a request to access the first container;
• providing, via the one or more processors, access to the first container;
• sending, via the one or more processors, an alert regarding the request to access the first container to a computing device of a second entity that has access to the first container, wherein the second entity is different than the first entity;
• receiving, via the one or more processors and from the computing device of the second entity after sending the alert, an indication that the request to access the first container is a potential security threat;
• and
• in response to receiving the indication:
• generating, via the one or more processors, a second image comprising a copy of the first image;
• and
• switching, via the one or more processors, from providing access to the first container to providing access to a second container comprising an execution of the second image.