Fine grained container security
A system for a containerized application includes an interface and a processor. The interface is configured to receive an indication from a user to create a containerized application. The indication comprises a first user authentication information (e.g., an authentication token issued by an authentication server) and an application permission information. The processor is configured to determine whether the first user authentication information indicates that the user has permission to create a definition for the containerized application with the application permission information, and, if so, create the definition for the containerized application with the application permission information. The processor is configured to determine whether a second user authentication information indicates that the user has permission to execute the containerized application using the definition for the containerized application, and, if so, indicate to process a job using the containerized application.
1. A system for a containerized application, comprising:
an interface configured to:
receive an indication of a request from a user to create a containerized application, wherein the indication comprises a first user authentication information and an application permission information for the containerized application, wherein the first user authentication information comprises an authentication token issued by an authentication server for the user request upon an initial user login into the system; and
a hardware processor configured to:
determine whether the first user authentication information indicates that the user has permission to create a definition for the containerized application with the application permission information; and
in the event that the first user authentication information indicates the user has permission to execute the containerized application with the application permission information, create the definition for the containerized application, which can be used to execute the containerized application in a container, with the application permission information;
determine whether a second user authentication information indicates that the user has permission to execute the containerized application using the definition for the containerized application, wherein determining whether the second user authentication information indicates that the user has permission to execute the containerized application is based at least in part on the application permission information associated with the containerized application; and
in the event the second user authentication information indicates that the user has permission to execute the containerized application using the definition for the containerized application, indicate to process a job by executing the containerized application in the container.
2. The system of claim 1 , wherein the interface is further configured to:
receive a job indication to process a job using the containerized application, wherein the job indication comprises the second user authentication information.
3. The system of claim 1 , wherein the first user authentication information and the second user authentication information comprise authentication tokens.
4. The system of claim 3 , wherein authentication tokens comprise authentication tokens issued by an authentication server.
5. The system of claim 3 , wherein authentication tokens comprise cryptographic authentication tokens.
6. The system of claim 3 , wherein authentication tokens are issued by an authentication server in response to authentication information.
7. The system of claim 6 , wherein authentication information comprises a username and password, single sign on information, LDAP information, or PKI information.
8. The system of claim 1 , wherein determining whether the first user authentication information indicates that the user has permission to create the containerized application with the application permission information comprises:
querying an authentication server for first user permission information using the first user authentication information;
receiving first user permission information from the authentication server; and
comparing the first user permission information with the application permission information.
9. The system of claim 8 , wherein determining whether the first user authentication information indicates that the user has permission to create the containerized application with the application permission information additionally comprises:
storing the first user permission information in a cache.
10. The system of claim 1 , wherein determining whether the first user authentication information indicates that the user has permission to create the containerized application with the application permission information comprises:
receiving first user permission information from a cache;
determining whether the first user permission information is current; and
in the event the first user permission information is still current:
comparing the first user permission information with the application permission information.
11. The system of claim 10 , wherein the first user permission information comprises a first user directory path in which the user is allowed to create the containerized application.
12. The system of claim 11 , wherein a second user permission information comprising a second user directory path in which the user is allowed to execute the containerized application is distinct from the first user permission information comprising the first user directory path.
13. The system of claim 11 , wherein comparing the first user permission information with the application permission information comprises determining whether an application directory path associated with the application permission information comprises a subpath of the first user directory path.
14. The system of claim 11 , wherein the first user permission information is based at least in part on a role associated with the user.
15. The system of claim 1 , wherein determining whether the second user authentication information indicates that the user has permission to execute the containerized application comprises:
querying an authentication server for second user permission information using the second user authentication information;
receiving second user permission information from the authentication server; and
comparing the second user permission information with the application permission information associated with the containerized application.
16. The system of claim 1 , wherein indicating to process the job using the containerized application comprises:
determining whether an available resource indication has been received comprising sufficient available resources to process the job using the containerized application; and
in the event it is determined that an available resource indication has been received comprising sufficient available resources to process the job using the containerized application, providing a request to process the job using the containerized application.
17. The system of claim 1 , wherein processing the job using the containerized application comprises:
creating a container; and
executing the containerized application in the container.
18. The system of claim 1 , wherein the processor is further configured to:
determine whether third user authentication information indicates that the user has permission to query the containerized application; and
in the event it is determined that the third user authentication information indicates that the user has permission to query the containerized application:
provide a query indication to query the containerized application.
19. The system of claim 18 , wherein querying the containerized application comprises one or more of the following query types: determining application progress, determining application metadata, determining application logs, or determining application metrics.
20. The system of claim 18 , wherein a third user permission information comprising a third user directory path in which the user is allowed to query the containerized application is based at least in part on a query type.
21. The system of claim 1 , wherein the processor is further configured to:
determine whether a fourth user authentication information indicates that the user has permission to update a configuration associated with the containerized application; and
in the event it is determined that the fourth user authentication information indicates that the user has permission to update permissions:
provide an indication to update the configuration associated with the containerized application.
22. The system of claim 1 , wherein the processor is further configured to perform one or more of the following: viewing, accessing, creation, running, completing, reading, updating, or deleting of the containerized application or the definition of the containerized definition.
23. A method for a containerized application, comprising:
receiving an indication of a request from a user to create a containerized application, wherein the indication comprises a first user authentication information and an application permission information for the containerized application, wherein the first user authentication information comprises an authentication token issued by an authentication server for the user request upon an initial user login into the system;
determining, using a processor, whether the first user authentication information indicates that the user has permission to create a definition for the containerized application with the application permission information;
in the event that the first user authentication information indicates the user has permission to execute the containerized application with the application permission information, creating the definition for the containerized application, which can be used to execute the containerized application in a container, with the application permission information;
determining whether a second user authentication information indicates that the user has permission to execute the containerized application using the definition for the containerized application, wherein determining whether the second user authentication information indicates that the user has permission to execute the containerized application using the definition for the containerized application is based at least in part on the application permission information associated with the containerized application; and
in the event the second user authentication information indicates that the user has permission to execute the containerized application, indicating to process a job by executing the containerized application in the container.
24. A computer program product embodied in a non-transitory computer readable storage medium for a containerized application comprising computer instructions when executed to perform functions of:
receiving an indication of a request from a user to create a containerized application, wherein the indication comprises a first user authentication information and an application permission information for the containerized application, wherein the first user authentication information comprises an authentication token issued by an authentication server for the user request upon an initial user login into the system;
determining whether the first user authentication information indicates that the user has permission to create a definition for the containerized application with the application permission information;
in the event that the first user authentication information indicates the user has permission to execute the containerized application with the application permission information, creating the definition for the containerized application, which can be used to execute the containerized application in a container, with the application permission information;
determining whether a second user authentication information indicates that the user has permission to execute the containerized application using the definition for the containerized application, wherein determining whether the second user authentication information indicates that the user has permission to execute the containerized application using the definition for the containerized application is based at least in part on the application permission information associated with the containerized application; and
in the event the second user authentication information indicates that the user has permission to execute the containerized application, indicating to process a job by executing the containerized application in the container.