Automated container security

A system in a distributed network of application containers comprising:

• a processor;
• and
• a computer-readable storage medium having stored therein instructions which, when executed by the processor, cause the processor to perform operations comprising:
• gathering security threat intelligence;
• identifying, in the security threat intelligence, a security threat;
• automatically identifying an application container that is affected by the security threat;
• determining a threat level for the security threat on the application container;
• applying a threat mitigation policy on the affected application container based on the threat level;
• spawning a clone of the affected application container;
• testing one or more security fixes on the clone of the affected application container;
• and
• after the testing is successful, deploying the clone of the affected container as a replacement for the affected container.

A non-transitory computer-readable storage medium having stored therein instructions which, when executed by a processor, cause the processor to perform operations comprising

• gathering security threat intelligence;
• identifying, in the security threat intelligence, a security threat;
• automatically identifying an application container that is affected by the security threat;
• determining a threat level for the security threat on the application container;
• applying a threat mitigation policy on the affected application container based on the threat level;
• spawning a clone of the affected application container;
• testing one or more security fixes on the clone of the affected application container;
• and
• after the testing is successful, deploying the clone of the affected container as a replacement for the affected container.

A computer-implemented method comprising:

• identifying a security threat for an application container;
• spawning a clone of the affected application container;
• testing one or more security fixes on the clone of the affected application container;
• and
• deploying the clone of the affected container as a replacement for the affected container.

A computer-implemented method comprising:

• gathering threat intelligence;
• correlating the threat intelligence to identify a security threat;
• automatically identifying an application container that is affected by the security threat;
• determining a threat level for the security threat on the application container;
• applying a threat mitigation policy on the affected application container based on the threat level.