# US 2016/0366104 A1 · Container-based system administration > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366104 A1 - Document ID: US20160366104A1 - Status: Published application - Kind: A1 - Application number: 14/736,297 - Filed: 2015-06-11 - Published: 2016-12-15 - Earliest claimed: 2015-06-11 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: GEORGE GOLDBERG; YOSEF MOATTI; Dmitry Sotnikov; YARON WEINSBERG - Web page: https://patentgrep.com/patent/US20160366104A1 ## CPC - H04L 63/102: {Entity profiles} - G06F 3/023: Arrangements for converting discrete items of information into a coded form, e.g. arrangements for interpreting keyboard generated codes as alphanumeric codes, operand codes or instruction codes - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/554: {involving event detection and direct action} - G06F 2009/45587: {Isolation or security of virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods, computing systems and computer program products implement embodiments of the present invention that include defining a first multiple of software container configurations and a second multiple of permission sets, and receiving, by a first computer, a request to perform a service operation on a second computer having multiple resources. Upon identifying one or more of the resources that are required for the service operation, a given software container configuration and a given permission set are selected based on the identified one or more resources, and the given software container configuration and the given permission set are conveyed to the second computer. Upon the second computer receiving the given software container configuration and the given permission set, a software container is generated. The software container is opened on the host computer prior to performing the service operation, and closed upon completing the service operation. ## Claims ### Claim 1 A method, comprising: defining a first multiple of software container configurations and a second multiple of permission sets; receiving, by a first computer, a request to perform a service operation on a second computer having multiple resources; identifying one or more of the resources that are required for the service operation; selecting, based on the identified one or more resources, a given software container configuration and a given permission set; and conveying the given software container configuration and the given permission set to the second computer. ### Claim 2 (depends on 1) The method according to claim 1, and comprising receiving, by the second computer, the given software container configuration and the given permission set, generating, using the given software container configuration and the given permission set, a software container, starting to execute the generated software container prior to performing the service operation, and closing the generated container upon completing the service operation. ### Claim 3 (depends on 2) The method according to claim 2, wherein performing the software operation comprises executing, by the second computer, a software process, and comprising continuing to execute the software process upon closing the software container. ### Claim 4 (depends on 2) The method according to claim 2, and comprising creating, while performing the service operation, an event log comprising multiple events. ### Claim 5 (depends on 4) The method according to claim 4, wherein creating the event log comprises conveying, by the second computer, each of the events to a third computer, and synchronously storing, by the third computer, the events to the event log, and comprising closing, by the third computer, the software container upon detecting a given event comprising a suspicious activity. ### Claim 6 (depends on 1) The method according to claim 1, wherein each given software container configuration and each given permission set has access to a subset of the resources. ### Claim 7 (depends on 1) The method according to claim 1, wherein the second computer comprises a virtual machine. ### Claim 8 A computing facility, comprising: multiple computers configured to communicate over a network, wherein a first given computer is configured: to define a first multiple of software container configurations and a second number of permission sets, to receive a request to perform a service operation on a second given computer having multiple resources, to identify one or more of the resources that are required for the service operation, to select, based on the identified one or more resources, a given software container configuration and a given permission set, and to convey the given software container configuration and the given permission set to the second given computer. ### Claim 9 (depends on 8) The computing facility according to claim 8, wherein the second computer is configured to receive given software container configuration and the given permission set, to generate, using the given software container configuration and the given permission set, a software container, to start to execute the generated software container prior to performing the service operation, and to close the generated container upon completing the service operation. ### Claim 10 (depends on 9) The computing facility according to claim 9, wherein the second computer is configured to perform the software operation by executing a software process, and wherein the second computer is configured to continue to execute the software process upon closing the software container. ### Claim 11 (depends on 9) The computing facility according to claim 9, wherein the second computer is configured to create, while performing the service operation, an event log comprising multiple events. ### Claim 12 (depends on 11) The computing facility according to claim 11, wherein the second computer is configured to create the event log by conveying each of the events to a third given computer, and wherein the third computer is configured to synchronously store the events to the event log, and to close the software container upon detecting a given event comprising a suspicious activity. ### Claim 13 (depends on 8) The computing facility according to claim 8, wherein each given software container configuration and each given permission set has access to a subset of the resources. ### Claim 14 (depends on 8) The computing facility according to claim 8, wherein the second computer comprises a virtual machine. ### Claim 15 A computer program product, the computer program product comprising: a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code executing on a first computer and comprising: computer readable program code configured to define a first multiple of software container configurations and a second multiple of permission sets; computer readable program code configured to receive a request to perform a service operation on a second computer having multiple resources; computer readable program code configured to identify one or more of the resources that are required for the service operation; computer readable program code configured to select, based on the identified one or more resources, a given software container configuration and a given permission set; and computer readable program code configured to convey the given software container configuration and the given permission set to the second computer. ### Claim 16 (depends on 15) The computer program product according to claim 15, and comprising computer readable program code executing on the second computer and configured to receive the given software container configuration and the given permission set, to generate, using the given software container configuration and the given permission set, a software container, to start to execute the generated software container prior to performing the service operation, and to close the generated container upon completing the service operation. ### Claim 17 (depends on 16) The computer program product according to claim 16, wherein the computer readable program code executing on the second computer is configured to perform the software operation by executing a software process, and comprising computer readable program code executing on the second computer and configured to continue to execute the software process upon closing the software container. ### Claim 18 (depends on 16) The computer program product according to claim 16, and comprising computer readable program code executing on the second computer and configured to create, while performing the service operation, an event log comprising multiple events. ### Claim 19 (depends on 18) The computer program product according to claim 18, wherein the computer readable program code executing on the second computer is configured to create the event log by conveying each of the events to a third computer, and comprising computer readable program code executing on the third computer and configured to synchronously store the events to the event log, and to close the software container upon detecting a given event comprising a suspicious activity. ### Claim 20 (depends on 15) The computer program product according to claim 15, wherein the second computer comprises a virtual machine.