Transparent Network Security For Application Containers

A computing server comprising:

• a container service executing on the server, the container service providing an application programming interface for operating system-level virtualization;
• a virtual switch, the virtual switch configured to route network packets;
• an application container including an image having executable code;
• and
• a security container executing on the server, and configured to:
• receive from the container service an indication of the application container being connected to the virtual switch;
• disconnect a first connection from the virtual switch to the application container at the application container;
• connect the first connection from the virtual switch to the security container;
• establish a second connection from the security container to the application container;
• receive data from the application container;
• inspect the received data for network security;
• and
• transmit the received data to an intended destination via the virtual switch.

A non-transitory computer storage readable medium configured to store instructions, the instructions that when executed by a processor, cause the processor to:

• receive, at a security container, an indication of a new application container connected to a virtual switch of a server, the connection established by a container service providing operating system-level virtualization for each application container;
• disconnect a first connection from the virtual switch to the application container at the application container;
• connect the first connection from the virtual switch to the security container;
• establish a second connection from the security container to the application container;
• receive data from the application container;
• inspect the received data for network security;
• and
• transmit the received data to an intended destination via the virtual switch.