Network context monitoring within service mesh containerization environment

1. A computer-implemented method, comprising:

opening a socket to a loopback interface of an application container, wherein the application container participates in a service mesh and communicates with a plurality of remote application containers in the service mesh via a service mesh proxy associated with the application container;

receiving, through the socket of the loopback interface, a plurality of data packets, the data packets being part of one or more network sessions of the service mesh, at least one of the network sessions is encrypted at the service mesh proxy;

identifying a particular network session of the application container with a particular remote application container through analyzing the plurality of data packets received through the socket; and

monitoring security associated with the particular network session of the service mesh.

2. The computer-implemented method of claim 1 , wherein the application container is isolated using operating system-level virtualization.

3. The computer-implemented method of claim 1 , wherein the particular network session of the application container is identified based on network address identified from packet data in network communications at the loopback interface.

4. The computer-implemented method of claim 1 , wherein the particular network session of the application container is identified based on port information identified from packet data in network communications at the loopback interface.

5. The computer-implemented method of claim 1 , further comprising:

extracting a source network address and port information from incoming packet data;

extracting a destination network address and port information from outgoing packet data; and

comparing the source network address and port number of the incoming packet data with the destination network address and port information of outgoing packet data;

identifying packets of the incoming packet data with the source network address and port information matching the destination network address and port information of packets of the outgoing packet data as a set of ingress connection packets; and

determining that the set of ingress connection packets belongs to the particular network session.

6. The computer-implemented method of claim 5 , further comprising:

determining that particular network session is an ingress connection by determining that the destination network address and port information indicates a network address of an ethernet interface.

7. The computer-implemented method of claim 6 , wherein the application container functions as a server.

8. The computer-implemented method of claim 1 , further comprising:

determining whether the application container is coupled to the service mesh proxy by:

determining whether network addresses at an ethernet interface matches network addresses at the loopback interface; and

in response to determining that the network addresses at the ethernet interface do not match the network addresses at the loopback interface, determining that the application container is coupled to the service mesh proxy.

9. The computer-implemented method of claim 1 , further comprising:

transmitting a report including information about the particular network session, the report further including a reconstruction of payload data of packet data in the particular network session.

10. A system comprising:

an application container, wherein the application container participates in a service mesh;

a service mesh proxy connected to the application container, wherein the service mesh proxy allows the application container to communicate with a plurality of remote application containers in the service mesh via the service mesh proxy; and

a computing device comprising one or more processors and memory, the memory configured to store computer code comprising instructions, the instructions, when executed by the one or more processors, cause the one or more processors to:

open a socket to a loopback interface of the application container;

receive, through the socket of the loopback interface, a plurality of data packets, the data packets being part of one or more network sessions of the service mesh, at least one of the network sessions is encrypted at the service mesh proxy;

identify a particular network session of the application container with a particular remote application container through analyzing the plurality of data packets received through the socket; and

monitor security associated with the particular network session of the service mesh.

11. The system of claim 10 , wherein the application container is isolated using operating system-level virtualization.

12. The system of claim 10 , wherein the particular network session of the application container is identified based on network address identified from packet data in network communications at the loopback interface.

13. The system of claim 10 , wherein the particular network session of the application container is identified based on port information identified from packet data in network communications at the loopback interface.

14. The system of claim 10 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:

extract a source network address and port information from incoming packet data;

extract a destination network address and port information from outgoing packet data; and

compare the source network address and port number of the incoming packet data with the destination network address and port information of outgoing packet data;

identify packets of the incoming packet data with the source network address and port information matching the destination network address and port information of packets of the outgoing packet data as a set of ingress connection packets; and

determine that the set of ingress connection packets belongs to the particular network session.

15. The system of claim 14 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:

determine that particular network session is an ingress connection by determining that the destination network address and port information indicates a network address of an ethernet interface.

16. The system of claim 15 , wherein the application container functions as a server.

17. The system of claim 10 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:

determine whether the application container is coupled to the service mesh proxy by:

determining whether network addresses at an ethernet interface matches network addresses at the loopback interface; and

in response to determining that the network addresses at the ethernet interface do not match the network addresses at the loopback interface, determining that the application container is coupled to the service mesh proxy.

18. The system of claim 10 , wherein the application container and the service mesh proxy are stored in the memory of the computing device.

19. A non-transitory computer-readable medium configured to store computer code comprising instructions, the instructions, when executed by one or more processors, cause the one or more processors to:

open a socket to a loopback interface of an application container, wherein the application container participates in a service mesh and communicates with a plurality of remote application containers in the service mesh via a service mesh proxy associated with the application container;

receive, through the socket of the loopback interface, a plurality of data packets, the data packets being part of one or more network sessions of the service mesh, at least one of the network sessions is encrypted at the service mesh proxy;

identify a particular network session of the application container with a particular remote application container through analyzing the plurality of data packets received through the socket; and

monitor security associated with the particular network session of the service mesh.

20. The non-transitory computer-readable medium of claim 19 , wherein the particular network session of the application container is identified based on network address identified from packet data in network communications at the loopback interface.