Generation of security policies for container execution

A computer system comprising:

• a memory;
• and
• a processor in communication with the memory, wherein the computer system is configured to perform a method comprising:
• performing automated static analysis of binary code of a containerized application and generating, based on the static analysis, a control-flow graph of expected runtime execution flow of the containerized application, the containerized application providing an expected set of functionality when properly executing;
• inferring, from the expected runtime execution flow of the containerized application informed by the control-flow graph, security policy configurations for a plurality of resources used in execution of the containerized application and that suffice for the containerized application to provide the expected set of functionality;
• and
• automatically generating, as part of one or more configuration files used in deploying a container having the containerized application for execution, a security policy for execution of the container including the containerized application thereof, the security policy specifying the security policy configurations for the plurality of resources used in the execution of the containerized application.

A computer program product comprising:

• a computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising:
• performing automated static analysis of binary code of a containerized application and generating, based on the static analysis, a control-flow graph of expected runtime execution flow of the containerized application, the containerized application providing an expected set of functionality when properly executing;
• inferring, from the expected runtime execution flow of the containerized application informed by the control-flow graph, security policy configurations for a plurality of resources used in execution of the containerized application and that suffice for the containerized application to provide the expected set of functionality;
• and
• automatically generating, as part of one or more configuration files used in deploying a container having the containerized application for execution, a security policy for execution of the container including the containerized application thereof, the security policy specifying the security policy configurations for the plurality of resources used in the execution of the containerized application.