Securing Shared Components

In a container based computing environment comprising a computing system having a first operating system and a second operating system, a method of providing access control by the first operating system, the method comprising:

• receiving at the first operating system, from the second operating system, a request for a bounding reference to a set having at least one resource;
• obtaining a first operating system provided bounding reference for the set, wherein the bounding reference comprises a reference created from a first operating system resolvable reference to the set where the bounding reference is created in a fashion to prevent the second operating system from directly accessing the set using the bounding reference;
• providing the obtained bounding reference for the obtained provided bounding reference to the second operating system;
• receiving from the second operating system, a request for the set, wherein the request for the set comprises the obtained bounding reference and an identifier identifying the second operating system;
• evaluating the obtained bounding reference and the identifier identifying the second operating system;
• and
• as a result of evaluating the obtained bounding reference and the identifier identifying the second operating system, performing a resource control action.

A computer system comprising:

• a host operating system configured to host one or more container operating systems;
• a container operating system hosted by the host operating system;
• a handle store disposed in the host operating system, wherein the handle store is configured to store and correlate a handle to a resource, a bounding reference correlated to the handle, and an identifier identifying the container operating system;
• an application in the container operating system, wherein the application is configured to perform a request for the resource to the host operating system, where the request comprises the bounding reference to the resource and the identifier identifying the container operating system;
• and
• wherein the host operating system is configured to:
• evaluate the bounding reference and the identifier identifying the container operating system in the request from the container operating system;
• and
• as a result of evaluating the obtained bounding reference and the identifier identifying the container operating system, perform a resource control action.