Allow list of container images based on deployment configuration at a container orchestration service

A method implemented at a computing system for detecting anomalies in deployment configurations of container images at a container network, the method comprising:

• collecting one or more datasets associated with one or more deployment configurations of a container image via a container orchestration service;
• extracting a plurality of features based on the one or more datasets for an ID of the container image;
• generating a probability score based on the plurality of features, using one or more machine-learning models trained on datasets associated with one or more historical deployment configurations of the container image that have been performed via the container orchestration service, the probability score indicating a probability of whether the one or more deployment configurations of the container image are anomalous or not anomalous when compared to the one or more historical deployment configurations of the container image;
• and
• generating an allow list that includes container images and their respective IDs that have one or more deployment configurations that are not anomalous.

A computing system comprising:

• one or more processors;
• and
• one or more computer-readable hardware storage devices having stored thereon computer-executable instructions that are structured such that, when executed by the one or more processors, the computer-executable instructions cause the computing system to perform at least:
• obtain training data associated with historical deployment configurations of a container image via a container orchestration service;
• extract a plurality of features for the historical deployment configurations of container images based on the training data;
• select one or more collections of features among the plurality of features;
• and
• for each of the one or more collections of features, train an anomaly detection model using machine learning, such that the anomaly detection model is configured to generate a probability score for a given dataset associated with one or more deployment configurations of the container image via the container orchestration service, indicating a probability that the one or more deployment configurations of the container image are anomalous compared to the historical deployment configurations.