Protection for a computer system that executes containers

A non-transitory computer-readable medium comprising instructions that are executable in a host computer, wherein the instructions when executed cause the host computer to carry out a method of protecting a computer system from execution of container images that are not trustworthy, the method comprising:

• receiving a message from an application programming interface (API) server of a container orchestration system of the computer system, wherein the message indicates that a first container image has been requested for deployment;
• in response to receiving the message from the API server that the first container image has been requested, transmitting a request to an image evaluation service to evaluate whether the first container image is trustworthy for execution;
• and
• in response to receiving an indication from the image evaluation service that the first container image is not trustworthy, transmitting to the API server, an instruction not to deploy containers using the first container image.

A host computer configured to execute on a processor of a hardware platform to protect a computer system from execution of container images that are not trustworthy, wherein an image evaluation agent of the host computer is configured to execute on the processor to perform the following steps:

• receive a message from an application programming interface (API) server of a container orchestration system of the computer system, wherein the message indicates that a first container image has been requested for deployment;
• in response to receiving the message from the API server that the first container image has been requested, transmit a request to an image evaluation service to evaluate whether the first container image is trustworthy for execution;
• and
• in response to receiving an indication from the image evaluation service that the first container image is not trustworthy, transmit to the API server, an instruction not to deploy containers using the first container image.