Container runtime environment with distributed monitoring tasks and minimum privileges

1 . A container runtime environment comprising:

a plurality of workload containers, which share a kernel; and

container monitoring instances, realized as containers;

wherein each workload container of the plurality of workload containers includes a filesystem unique to the workload container; and

wherein:

the container monitoring instances monitor the plurality of workload containers;

monitoring of the plurality of workload containers is subdivided into a plurality of monitoring tasks;

each monitoring task of the plurality of monitoring tasks:

is assigned at least one privilege exclusively enabling an execution of the monitoring task; and

the execution of the monitoring task comprises enforcement of an assigned set of rules;

the container monitoring instances are respectively allocated the monitoring tasks; and

each of the container monitoring instances has the at least one privilege assigned to its respective monitoring task.

2 . The container runtime environment as claimed in claim 1 , wherein the monitoring task is selected from the group consisting of: monitoring started processes, setting up network connections, monitoring active network connections, monitoring write accesses, checking for weak points, limiting syscalls, allocating privileges, and/or monitoring privileges of the processes.

3 . The container runtime environment as claimed in claim 1 , wherein the at least one privilege allows the container monitoring instances to execute the monitoring task allocated thereto but no further monitoring tasks.

4 . The container runtime environment as claimed in claim 1 , wherein a first monitoring task of the monitoring tasks has a task portion which is not a task portion of a second monitoring task.

5 . The container runtime environment as claimed in claim 1 , wherein the monitoring tasks each have a task portion which is not a task portion of the rest of the monitoring tasks.

6 . The container runtime environment as claimed in claim 1 , wherein a plurality of container monitoring instances are allocated the same monitoring task.

7 . The container runtime environment as claimed in claim 1 , wherein the container monitoring instances are each allocated a plurality of monitoring tasks.

8 . The container runtime environment as claimed in claim 1 , wherein the container runtime environment runs on a device selected from the group consisting of: an industrial system, an industrial computer, an industrial device, a computer, a mobile device, a control device, a device of an Internet of Things environment, an edge device, a server, and/or a cloud server.

9 . The container runtime environment as claimed in claim 1 , wherein the container runtime environment is a Docker runtime environment.

10 . The container runtime environment as claimed in claim 1 , wherein each of the workload containers includes stacked filesystem layers.

11 . The container runtime environment as claimed in claim 10 , wherein each of the stacked filesystem layers of each of the workload containers is identified by a hash.

12 . A system comprising:

a technical device with a container runtime environment; and

a superordinate management system assigned to the technical device;

wherein the container runtime environment comprises:

a plurality of workload containers, which share a kernel; and

container monitoring instances, realized as containers;

wherein each workload container of the plurality of workload containers includes a filesystem unique to the workload container; and

wherein:

the container monitoring instances monitor the workload containers;

monitoring of the workload containers includes monitoring tasks;

each monitoring task of the monitoring tasks:

is assigned at least one privilege exclusively enabling an execution of the monitoring task; and

the execution of the monitoring task comprises enforcement of an assigned set of rules; and

each container monitoring instance of the container monitoring instances;

is allocated a monitoring task of the monitoring tasks; and

has the at least one privilege assigned to the monitoring task.

13 . The system as claimed in claim 12 , wherein:

the container monitoring instances were started by a monitor orchestration instance of the superordinate management system, or

the container monitoring instances were started by a scaling component implemented within the container runtime environment.

14 . The system as claimed in claim 12 , wherein a scaling component starts further container monitoring instances with identical monitoring tasks as a function of a capacity utilization of the container monitoring instances.

15 . The system as claimed in claim 12 , wherein a scaling component consults a monitoring instance policy.

16 . The system as claimed in claim 12 , further comprising:

at least one of:

a monitoring agent to produce an interface between a scaling component and the container monitoring instances; and

an interface between data sources and the container monitoring instances via which the container monitoring instances obtain data for carrying out their monitoring task.

17 . The system as claimed in claim 12 , wherein the workload containers were started by an application orchestration instance which is not designed to start the container monitoring instances.

18 . The system as claimed in claim 12 , wherein the container runtime environment is a Docker runtime environment.

19 . The system as claimed in claim 12 , wherein each of the workload containers includes stacked filesystem layers.

20 . The system as claimed in claim 19 , wherein each of the stacked filesystem layers of each of the workload containers is identified by a hash.