Transparent network security for application containers
A security container of a container environment receives an indication of a new application container connected to a virtual switch of a server, the connection established by a container service providing operating system-level virtualization for each application container. The security container disconnects a first connection from the virtual switch to the application container at the application container. The security container connects the first connection from the virtual switch to the security container. The security container establishes a second connection from the security container to the application container. The security container receives data from the application container. The security container inspects the received data for network security. The security container forwards the received data to an intended destination via the virtual switch.
1. A method comprising:
receiving, at a security container, an indication of a new application container connected to a virtual switch of a server, the connection established by a container service providing operating system-level virtualization for a plurality of application containers executing within an operating system, each application container of the plurality of application containers being a containerized software application, the container service limiting resources for each application container using one or more isolation features of the operating system;
disconnecting, by the security container, a first connection from the virtual switch to the new application container at the new application container;
responsive to receiving the indication of the new application container, connecting, by the security container, the first connection from the virtual switch to the security container;
establishing, by the security container, a second connection from the security container to the new application container;
receiving, at the security container, data from the new application container;
inspecting, by the security container, the received data for network security; and
transmitting, by the security container, the received data to an intended destination via the virtual switch.
2. The method of claim 1 , further comprising:
monitoring the server for an initiation of any new app container.
3. The method of claim 1 , wherein the disconnecting the first connection is in response to:
determining based on preconfigured rules that traffic of the new application container is to be intercepted, the preconfigured rules identifying one or more characteristics of the new application container.
4. The method of claim 1 , wherein the disconnecting the first connection further comprises:
storing one or more routing entries of the first connection;
switching a current namespace to a namespace of the application container; and
removing an interface of the first connection from the application container.
5. The method of claim 4 , wherein the connecting the first connection further comprises:
binding the interface of the first connection to the security container; and
restoring the one or more routing entries of the first connection.
6. The method of claim 1 , wherein the disconnecting the first connection further comprises:
storing one or more routing entries of the first connection; and
executing one or more system commands to remove an interface of the first connection from the application container.
7. The method of claim 1 , further comprising storing the network address of the application container, and wherein the establishing a second connection further comprises:
restoring the network address of the application container to the second connection.
8. A computing server comprising:
a container service executing on the server, the container service providing an application programming interface for operating system-level virtualization;
a virtual switch, the virtual switch configured to route network packets;
a new application container including an image having executable code, the new application container being a containerized software application, the container service limiting resources for the new application container using one or more isolation features of an operating system; and
a security container executing on the server, and configured to:
receive from the container service an indication of the new application container being connected to the virtual switch;
disconnect a first connection from the virtual switch to the new application container at the new application container;
responsive to the receipt of the indication of the new application container, connect the first connection from the virtual switch to the security container;
establish a second connection from the security container to the new application container;
receive, at the security container, data from the new application container;
inspect the received data for network security; and
transmit the received data to an intended destination via the virtual switch.
9. The server of claim 8 , wherein the security container is further configured to:
monitor the server for an initiation of any new app container.
10. The server of claim 8 , wherein the security container is further configured to disconnect the first connection is in response to a determination that the traffic of the new application container is to be intercepted based on preconfigured rules, the preconfigured rules identifying one or more characteristics of the new application container.
11. The server of claim 8 , wherein the security container is further configured to:
store one or more routing entries of the first connection;
switch a current namespace to a namespace of the application container; and
remove an interface of the first connection from the application container.
12. The server of claim 11 , wherein the security container is further configured to:
bind the interface of the first connection to the security container; and
restore the one or more routing entries of the first connection.
13. The server of claim 8 , wherein the security container is further configured to:
store one or more routing entries of the first connection; and
execute one or more system commands to remove an interface of the first connection from the application container.
14. The server of claim 8 , wherein the security container is further configured to store the network address of the application container prior to the disconnection of the first connection, and wherein the security container is further configured to:
restore the network address of the application container to the second connection.
15. A non-transitory computer storage readable medium configured to store instructions, the instructions that when executed by a processor, cause the processor to:
receive, at a security container, an indication of a new application container connected to a virtual switch of a server, the connection established by a container service providing operating system-level virtualization for a plurality of application containers executing within an operating system, each application container of the plurality of application containers being a containerized software application, the container service limiting resources for each application container using one or more isolation features of the operating system;
disconnect, by the security container, a first connection from the virtual switch to the new application container at the new application container;
responsive to the receipt of the indication of the new application container, connect the first connection from the virtual switch to the security container;
establish, by the security container, a second connection from the security container to the new application container;
receive, at the security container, data from the new application container;
inspect, by the security container, the received data for network security; and
transmit, by the security container, the received data to an intended destination via the virtual switch.
16. The non-transitory computer storage readable medium of claim 15 , wherein the non-transitory computer readable storage medium stores further instructions thereon, that when executed by the processor, causes the processor to:
monitor the server for an initiation of any new app container.
17. The non-transitory computer storage readable medium of claim 15 , wherein the non-transitory computer readable storage medium stores further instructions thereon, that when executed by the processor, causes the processor to:
disconnect the first connection is in response to a determination that the traffic of the new application container is to be intercepted based on preconfigured rules, the preconfigured rules identifying one or more characteristics of the new application container.
18. The non-transitory computer storage readable medium of claim 15 , wherein the non-transitory computer readable storage medium stores further instructions thereon, that when executed by the processor, causes the processor to:
store one or more routing entries of the first connection;
switch a current namespace to a namespace of the application container; and
remove an interface of the first connection from the application container.
19. The non-transitory computer storage readable medium of claim 18 , wherein the non-transitory computer readable storage medium stores further instructions thereon, that when executed by the processor, causes the processor to:
bind the interface of the first connection to the security container; and
restore the one or more routing entries of the first connection.
20. The non-transitory computer storage readable medium of claim 15 , wherein the non-transitory computer readable storage medium stores further instructions thereon, that when executed by the processor, causes the processor to:
store the network address of the application container prior to the disconnection of the first connection; and
restore the network address of the application container to the second connection.