Protection for a computer system that executes containers

A non-transitory computer-readable medium comprising instructions that are executable in a host computer, wherein the instructions when executed cause the host computer to carry out a method of protecting a computer system from execution of container images that are not trustworthy, the method comprising:

• determining that a container runtime of the computer system has downloaded a first container image for execution by the container runtime;
• in response to determining that the container runtime has downloaded the first container image, transmitting a request to an image evaluation service to evaluate whether the first container image is trustworthy for execution;
• and
• in response to receiving an indication from the image evaluation service that the first container image is not trustworthy, transmitting to the container runtime, an instruction to delete the first container image.

A host computer configured to execute on a processor of a hardware platform to protect a computer system from execution of container images that are not trustworthy, wherein an image evaluation agent of the host computer is configured to execute on the processor to perform the following steps:

• determine that a container runtime of the computer system has downloaded a first container image for execution by the container runtime;
• in response to determining that the container runtime has downloaded the first container image, transmit a request to an image evaluation service to evaluate whether the first container image is trustworthy for execution;
• and
• in response to receiving an indication from the image evaluation service that the first container image is not trustworthy, transmit to the container runtime, an instruction to delete the first container image.