Identifying container file events for providing container security

A non-transitory machine readable medium storing a program for providing security for containers executing in guest virtual machines (VMs) on a physical host machine, the program executable by a processing unit, the program comprising sets of instructions for:

• receiving a notification of a file access request, the notification comprising a path in a file system of the host machine being accessed by a process;
• determining, based on the path, whether the file access event is accessing a location in the file system to which container file systems are mapped;
• identifying a namespace of the process using an identification of the process included in the file path;
• determining the process is a container when the namespace belongs to a service implementing containers on the host machine;
• and
• sending an identifier of the container, an identification of a VM executing the container, and the file path to a set of security applications to determine whether the file access request to be allowed.

A system comprising:

• a set of processing unit;
• and
• a non-transitory machine readable medium storing a program for providing security for containers executing in guest virtual machines (VMs) on a physical host machine, the program executable by a processing unit, the program comprising sets of instructions for:
• receiving a notification of a file access request, the notification comprising a path in a file system of the host machine being accessed by a process;
• determining, based on the path, whether the file access event is for accessing a location in the file system to which container file systems are mapped;
• identifying a namespace of the process using an identification of the process included in the file path;
• determining the process is a container when the namespace belongs to a service implementing containers on the host machine;
• and
• sending an identifier of the container, an identification of a VM executing the container, and the file path to a set of security applications to determine whether the file access request to be allowed.