System for securing software containers with embedded agent

1. A computer-implemented method of providing security for a software container, comprising:

receiving a software container image comprising a software application and security agent that is separate from the software application, wherein an execution entry point of the software container image that was previously configured to launch the software application has been modified to instead launch the security agent;

receiving a request to instantiate the software container image as a software container;

launching the security agent based on the request;

authenticating the contents of the software container image;

preventing launch of the software application based on the authentication failing; and

based on the authentication succeeding:

launching the software application; and

controlling runtime operation of the software application from within the software container based on a security policy of the software application, wherein the controlling comprises:

implementing operating system hooks that are configured to intercept requests from the software application, wherein the operating system hooks are implemented prior to said launching the software application; and

controlling, from within the software container, whether intercepted requests of the software application are granted based on the security policy.

2. The computer-implemented method of claim 1 , wherein the operating system hooks are configured to detect one or more of:

file system access requested by the software application;

processes requested by the software application; and

network access requested by the software application.

3. The computer-implemented method of claim 1 , comprising:

receiving the security policy from a security server based on the authenticating;

transmitting a security notification from the security agent to the security server based on the software application attempting an action that violates the security policy; and

maintaining, by the security server, a log of security notifications received for the software application.

4. The computer-implemented method of claim 1 , wherein said authenticating the contents of the software container image comprises:

creating, by the security agent, a second cryptographic fingerprint based on the contents of the software container image and based on the request;

wherein said authenticating is based on a comparison of the second cryptographic fingerprint to a preexisting first cryptographic fingerprint that was previously created by the security agent based on the contents of the software container image.

5. The computer-implemented method of claim 4 , comprising:

transmitting the second cryptographic fingerprint to a security server for comparison against the preexisting first cryptographic fingerprint; and

determining whether the contents of the container image are authenticated based on a response received from the security server.

6. The computer-implemented method of claim 5 , comprising the security server:

receiving the first cryptographic fingerprint during a first time period;

receiving the second cryptographic fingerprint during a subsequent second time period;

comparing the first and second cryptographic fingerprints;

transmitting a notification to the security agent indicating that the software container image is authenticated based on the first and second cryptographic signatures matching; and

transmitting a notification to the security agent that the software container image is not authenticated based on the first and second cryptographic signatures not matching.

7. The computer-implemented method of claim 6 , comprising the security server:

transmitting a security policy for the software application to the security agent based on the first and second cryptographic signatures matching.

8. The computer-implemented method of claim 7 , comprising the security server:

determining an application type of the software application; and

selecting the security policy based on the application type.

9. The computer-implemented method of claim 8 , wherein said selecting the security policy based on the application type comprises:

selecting a default security policy of the application type for the software application based on a specific security policy for the software application not being received at the security server.

10. A computing device comprising:

memory configured to store a software container image that includes a software application and a security agent that is separate from the software application, wherein an execution entry point of the software container image that was previously configured to launch the software application has been modified to instead launch the security agent; and

a processor operatively connected to the memory and configured to:

receive a request to instantiate the software container image as a software container;

launch the security agent based on the request;

authenticate the contents of the software container image;

prevent launch of the software application based on the authentication failing; and

based on the authentication succeeding:

launch the software application; and

control runtime operation of the software application from within the software container based on a security policy of the software application, wherein to control runtime operation of the software application, the processor is configured to operate the security agent to:

implement operating system hooks that intercept requests from the software application, wherein the operating system hooks are implemented prior to launch of the software application; and

control, from within the software container, whether intercepted requests of the software application are granted based on the security policy.

11. The computing device of claim 10 , wherein the operating system hooks are configured to detect one or more of:

file system access requested by the software application;

processes requested by the software application; and

network access requested by the software application.

12. The computing device of claim 10 , wherein the processor is configured to:

operate the security agent to create a second cryptographic fingerprint based on the contents of the software container image and based on the request;

wherein the authentication is based on a comparison of the second cryptographic fingerprint to a preexisting first cryptographic fingerprint that was previously created by the security agent based on the contents of the software container image.

13. The computing device of claim 12 , wherein the processor is configured to:

transmit the second cryptographic fingerprint to a security server for comparison against the preexisting first cryptographic fingerprint; and

determine whether the contents of the container image are authenticated based on a response received from the security server.