Abstract: A policy interpreter detects that an application container has been added in a container system, and opens a stored manifest for the application container. The policy interpreter retrieves running services information regarding the application container, and generates a security policy for the application container. The security policy defines a set of actions for which the application container can perform, and the set of actions are determined using the manifest and the running service information associated with the application container. The policy interpreter loads the security policy at a security container. The security container blocks an action performed by the application container in response to determining that the action performed by the application container does not match any action in the set of actions defined in the security policy. The policy interpreter transmits the security policy to a graphical user interface container for presentation to a user via a display device.

Abstract: A threat level analyzer probes for one or more threats within an application container in a container system. Each threat is a vulnerability or a non-conformance with a benchmark setting. The threat level analyzer further probes for one or more threats within a host of the container service. The threat level analyzer generates a threat level assessment score based on results from the probing of the one or more threats of the application container and the one or more threats of the host, and generates a report for presentation in a user interface including the threat level assessment score and a list of threats discovered from the probe of the application container and the host. A report is transmitted by the threat level analyzer to a client device of a user for presentation in the user interface.

Abstract: A security monitor monitors network communications at a loopback interface of a pod in the container system. The pod includes a service mesh proxy and an application container. The application container includes computer-readable instructions and is initiated via a container service and is isolated using operating system-level virtualization. The application container communicates with the service mesh proxy using the loopback interface. The security monitor extracts network address and port information from packet data in the network communications at the loopback interface. The security monitor determines one or more connection contexts of the network communications at the loopback interface, each connection context used to identify a network session of the application container with a remote application container.

Abstract: A security container of a container environment receives an indication of a new application container connected to a virtual switch of a server, the connection established by a container service providing operating system-level virtualization for each application container. The security container disconnects a first connection from the virtual switch to the application container at the application container. The security container connects the first connection from the virtual switch to the security container. The security container establishes a second connection from the security container to the application container. The security container receives data from the application container. The security container inspects the received data for network security. The security container forwards the received data to an intended destination via the virtual switch.

Abstract: The various implementations described herein include systems, methods and/or devices method for applying security policies in a virtualization environment. In one aspect, the method is performed at an electronic device of a plurality of electronic devices in a computing network, the electronic device having one or more processors and memory storing instructions for execution by the one or more processors. A plurality of user-space instances is instantiated. Respective properties that characterize the user-space instances are identified, and based on the identified properties, respective security policies that define authorized or unauthorized operations and data communications for user-space instances are identified. Furthermore, the identified security policies are applied so as to detect and/or remediate violations of the identified set of security policies.

Abstract: A security container of a container environment receives an indication of a new application container connected to a virtual switch of a server, the connection established by a container service providing operating system-level virtualization for each application container. The security container disconnects a first connection from the virtual switch to the application container at the application container. The security container connects the first connection from the virtual switch to the security container. The security container establishes a second connection from the security container to the application container. The security container receives data from the application container. The security container inspects the received data for network security. The security container forwards the received data to an intended destination via the virtual switch.

Abstract: The various implementations described herein include systems, methods and/or devices method for applying security policies in a virtualization environment. In one aspect, the method is performed at an electronic device of a plurality of electronic devices in a computing network, the electronic device having one or more processors and memory storing instructions for execution by the one or more processors. A plurality of user-space instances is instantiated. Furthermore, a security instance distinct from the plurality of user-space instances is instantiated. The security instance, which executes in user space of a respective virtual address space, monitors operations and data communications for the plurality of user-space instances. The security instance applies security policies to the monitored operations and data communications for the plurality of user-space instances so as to detect and/or remediate violations of the security policies.

Abstract: A security container of a container environment monitors a resource load in a container environment, the container environment including a container service providing operating system-level virtualization for one or more application containers connected to a virtual switch within the container environment, the one or more application containers having their traffic intercepted by the security container for inspection. The security container activates, in response to determining that the monitored resource load meets a condition in a network load policy, a new security container. The security container determines a subset of the one or more application containers to be associated with the new security container, and transfers the network connections and network sessions of the subset of the one or more application containers to the new security container.

Abstract: A system comprises one or more application containers, each application container including computer-readable instructions and initiated via a container service and isolated using operating system-level virtualization. The system also comprises one or more virtual switches configured to route traffic from the application containers. The system further comprises one or more security containers, each security container configured to transparently intercept traffic from the one or more application containers for analysis of network security. The system further comprises a user interface (UI) container configured to receive configuration settings from a user. The system also comprises an analytics container configured to perform analysis on data received from the one or more security containers. The system also comprises a management container configured to configure settings for the one or more security containers and the analytics container.