Application layer data protection for containers in a containerization environment

A container system comprising:

• one or more application containers;
• an intercept container that is enabled by the kernel and shares the kernel with the one or more application containers, the intercept container configured to:
• monitor one or more activities of the one or more application containers, wherein monitoring the one or more activities comprises:
• intercepting, by an intercept container, a network activity of an application container of the one or more application containers attempting to transmit a file to a network destination outside of the container system, wherein content of the file is obfuscated outside of the application container;
• and
• obtaining, by the intercept container using a kernel of the operating system to access the application container, an encryption key that is used to access an unobfuscated content of the file that corresponds to the network activity prior to the obfuscation;
• inspect the content of the file attempting to be transmitted to the network destination associated with the network activity and applying, by the intercept container, one or more regular expressions representing patterns of sensitive personal data to the unobfuscated content of the file that is obtained using the kernel to find whether one or more regular expression matches exist in the content of the file;
• determine, in response to one or more regular expression matches are found, that the network activity attempting to transmit the file to the network destination involves an attempt to transmit the sensitive personal data out of the application container;
• trigger an action specified in the policy in response to determining that the network activity involves the attempt to transmit the sensitive personal data out of the application container.

A non-transitory computer storage readable medium configured to store instructions, the instructions, when executed by a processor, cause the processor to:

• monitor one or more activities of an application container in a container system, wherein the instruction to monitor of the one or more activities comprises instructions to:
• intercept, by an intercept container, a network activity of the application container attempting to transmit a file to a network destination outside of the container system, wherein content of the file is obfuscated outside of the application container;
• and
• obtaining, by the intercept container using a kernel of the operating system to access the application container, an encryption key that is used to access an unobfuscated content of the file that corresponds to the network activity prior to the obfuscation;
• inspect the content of the file attempting to be transmitted to the network destination associated with the network activity;
• and
• apply, by the intercept container, one or more regular expressions representing patterns of sensitive personal data to the unobfuscated content of the file that is obtained using the kernel to find whether one or more regular expression matches exist in the content of the file;
• determine, in response to one or more regular expression matches are found, that the network activity attempting to transmit the file to the network destination involves an attempt to transmit the sensitive personal data out of the application container;
• and
• trigger an action specified in the policy in response to determining that the network activity involves the attempt to transmit the sensitive personal data out of the application container.