Security policy generation using container metadata

A system for security in a container-based virtualization environment comprising:

• a hardware processor;
• and
• a memory coupled to the hardware processor, the memory storing instructions which are executable by the hardware processor to perform a method comprising:
• receiving metadata about a deployed container from a container orchestration layer, the metadata including an image type of the deployed container, the deployed container being deployed in a hardware server;
• determining an application or service performed by the deployed container from the received metadata;
• retrieving at least one model using the determined application or service, the at least one model identifying expected network communications behavior of the deployed container;
• generating a high-level declarative security policy associated with the deployed container using the at least one model, the high-level declarative security policy indicating at least an application or service with which the deployed container communicates;
• and
• launching a compiler, the compiler producing a low-level firewall rule set using the high-level declarative security policy, the low-level firewall rule set being provided to an enforcement point, the enforcement point applying the low-level firewall rule set to data network traffic.

A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for security in a container-based virtualization environment, the method comprising:

• receiving metadata about a deployed container from a container orchestration layer, the metadata including an image type of the deployed container, the deployed container being deployed in a hardware server;
• determining an application or service performed by the deployed container from the received metadata;
• retrieving at least one model using the determined application or service, the at least one model identifying expected network communications behavior of the deployed container;
• generating a high-level declarative security policy associated with the deployed container using the at least one model, the high-level declarative security policy indicating at least an application or service with which the deployed container communicates;
• and
• launching a compiler, the compiler producing a low-level firewall rule set using the high-level declarative security policy, the low-level firewall rule set being provided to an enforcement point, the enforcement point applying the low-level firewall rule set to data network traffic.