Security-based container scheduling

1. A security-based system for allocating a container to a node, comprising:

a processor; and

a memory resource storing a set of instructions executable by the processor, the set of instructions executable by the processor to:

discover a node in a cluster of nodes;

discover a node security attribute associated with the node based on metadata associated with the node;

generate a node selector from a container image security attribute specified in metadata associated with a container image, wherein the container is a running instance of the container image and the metadata associated with the container image is converted into the node selector for a template;

deploy the container to run on the node when the node security attribute matches the container image security attribute;

monitor a set of security resources in the cluster of nodes; and

allocate a security resource to the container and remove the security resource from a resource pool associated with the selected node.

2. The system of claim 1 , comprising instructions to create a label corresponding to the node security attribute and insert the label in metadata associated with the node.

3. The system of claim 2 , wherein the node selector is associated with the container image.

4. A computer implemented method for scheduling a container, comprising:

discover a node in a cluster of nodes and a node security attribute associated with the node;

generating a node selector from a container image security attribute specified in metadata associated with a container image, wherein the container is a running instance of the container image and the metadata associated with the container image is converted into the node selector for a template;

scheduling the container to a selected node in the cluster of nodes associated with a node security attribute that matches the node selector;

deploying the container to run on the selected node when the node security attribute matches the container image security attribute;

monitoring a set of security resources in the cluster of nodes; and

allocating a security resource to the container and remove the security resource from a resource pool associated with the selected node.

5. The method of claim 4 , further comprising creating a label corresponding to the node security attribute and inserting the label in metadata associated with the discovered node.

6. The method of claim 4 , further comprising associating the node selector with the container image via a container creation template.

7. The method of claim 4 , further comprising monitoring a set of security resources in the cluster of nodes.

8. The method of claim 4 , further comprising registering the node security attribute in a container resource database.

9. A non-transitory computer readable medium comprising instructions executable by a processor to:

discover a set of container hosting nodes within a specified scope;

discover a node security attribute for each of the discovered container hosting nodes;

insert the node security attribute discovered for a node in metadata associated with the node;

generate a node selector from a container image security attribute associated with a container image, wherein the metadata associated with the container image is converted into the node selector for a template;

deploy a container to run on a node selected by the node selector when the node security attribute matches the container image security attribute of the container image, wherein the container is a running instance of the container image;

monitor a set of security resources in the cluster of nodes; and

allocate a security resource to the container and remove the security resource from a resource pool associated with the selected node.

10. The non-transitory computer readable medium of claim 9 , wherein the set of container hosting nodes within a specified scope comprises one of a set of container hosting nodes connected to a switch, a set of container hosting nodes connected to a vLAN, a set of container hosting nodes connected to a rack, a set of container hosting nodes in a specified IP range, a set of container hosting nodes in a cluster of nodes, or a set of container hosting nodes in a logical group.

11. The non-transitory computer readable medium of claim 9 , wherein to discover a node security attribute comprises to generate a node security attribute command.

12. The non-transitory computer readable medium of claim 9 , further comprising instructions executable by the processor to schedule the container to a selected container hosting node from the set of discovered container hosting nodes having a node security attribute that matches the container image security attribute associated with the container image.