# US 2025/0156291 A1 · Container Runtime Environment with Distributed Monitoring Tasks and Minimum Privileges > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0156291 A1 - Document ID: US20250156291A1 - Status: Published application - Kind: A1 - Application number: 18/838,837 - Filed: 2023-01-30 - Published: 2025-05-15 - Earliest claimed: 2022-02-16 - Assignees: Siemens Aktiengesellschaft - Applicants: Siemens Aktiengesellschaft - Inventors: Christian Knierim; Christian Peter Feist - Web page: https://patentgrep.com/patent/US20250156291A1 ## CPC - G06F 11/302: {where the computing system component is a software system} - G06F 11/3051: {Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs (verification or detection of system hardware configuration G06F11/2247)} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/301: {where the computing system is a virtual computing platform, e.g. logically partitioned systems (virtual machines G06F9/45533; logical partitioning of resources G06F9/5077)} - G06F 11/3093: {Configuration details thereof, e.g. installation, enabling, spatial arrangement of the probes} - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 2201/815: Virtual - G06F 2201/865: Monitoring of software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Various embodiments of the teachings herein include a container runtime environment comprising: container application instances; and container monitoring instances. The container monitoring instances monitor the container application instances. Monitoring of the container application instances includes subdivided monitoring tasks. Each monitoring task is assigned at least one privilege exclusively enabling an execution of the respective assigned monitoring task. Execution of the monitoring task comprises enforcement of an assigned set of rules. The container monitoring instances are each allocated a monitoring task. The container monitoring instances each have the at least one privilege assigned to their monitoring task. ## Claims ### Claim 1 A container runtime environment comprising: container application instances; and container monitoring instances; wherein the container monitoring instances monitor the container application instances; monitoring of the container application instances includes subdivided monitoring tasks;, each monitoring task is assigned at least one privilege exclusively enabling an execution of the respective assigned monitoring task; execution of the monitoring task comprises enforcement of an assigned set of rules; the container monitoring instances are each allocated a monitoring task; and the container monitoring instances HAS+each have the at least one privilege assigned to their monitoring task. ### Claim 2 (depends on 1) The container runtime environment as claimed in claim 1 wherein the monitoring task is selected from the group consisting of: monitoring started processes, setting up network connections, monitoring active network connections, monitoring write accesses, checking for weak points, limiting syscalls, allocating privileges, and/or monitoring privileges of the processes. ### Claim 3 (depends on 1) The container runtime environment as claimed in claim 1, wherein the at least one privilege allows the container monitoring instances execute the monitoring task allocated thereto but no further monitoring tasks. ### Claim 4 (depends on 1) The container runtime environment as claimed in claim 1, wherein a first monitoring task of the monitoring tasks has a task portion which is not a task portion of a second monitoring task. ### Claim 5 (depends on 1) The container runtime environment as claimed in claim 1, wherein the monitoring tasks each have a task portion which is not a task portion of the rest of the monitoring tasks. ### Claim 6 (depends on 1) The container runtime environment as claimed in claim 1, wherein a plurality of container monitoring instances are allocated the same monitoring task. ### Claim 7 (depends on 1) The container runtime environment. as claimed in claim 1, wherein the container monitoring instances are each allocated a plurality of monitoring tasks. ### Claim 8 (depends on 1) The container runtime environment. as claimed in claim 1, wherein the container runtime environment runs on a device selected from the group consisting of: an industrial system, an industrial computer, an industrial device, a computer, a mobile device, a control device, a device of an Internet of Things environment, an edge device, a server, and/or a cloud server. ### Claim 9 (canceled) ### Claim 10 A system comprising: a technical device with container runtime environment; and a superordinate management system assigned to the technical device; wherein the container runtime environment comprises: container application instances; and container monitoring instances; wherein the container monitoring instances monitor the container application instances; monitoring of the container application instances includes subdivided monitoring tasks; each monitoring task is assigned at least one privilege exclusively enabling an execution of the respective assigned monitoring task; execution of the monitoring task comprises enforcement of an assigned set of rules; the container monitoring instances are each allocated monitoring task; and the container monitoring instances each have the at least one privilege assigned to their monitoring task. ### Claim 11 (depends on 10) The system as claimed in claim 10, wherein: the container monitoring instances were started by a monitor orchestration instance-of the superordinate management system, or the container monitoring instances were started by a scaling component implemented within the container runtime environment. ### Claim 12 (depends on 10) The system as claimed in claim 10, wherein the scaling component starts further container monitoring instances with identical monitoring tasks as a function of a capacity utilization of the container monitoring instances. ### Claim 13 (depends on 10) The system as claimed in claim 10, wherein the scaling component consults a monitoring instance policy. ### Claim 14 (depends on 10) The system as claimed in claim 10, further comprising: a monitoring agent to produce an interface between the scaling component and the container monitoring instances and/or an interface between data sources and the container monitoring instances via which the container monitoring instances obtain data for carrying out their monitoring task. ### Claim 15 (depends on 10) The system as claimed in claim 10, wherein the container application instances were started by an application orchestration instance which is not designed to start the container monitoring instances.