Automatic vulnerability mitigation

1. A method for automatic vulnerability mitigation, comprising:

creating an image for a containerized application;

identifying, from the image, one or more main processes of the containerized application, the one or more main processes comprising a first subset of a plurality of processes of the containerized application;

starting, within a sandbox environment, the containerized application;

determining, based on the started containerized application within the sandbox environment, a second subset of processes within the plurality, the second subset including one or more dependent processes associated with and dependent on the one or more main processes comprising the first subset;

determining a third subset of non-dependent processes within the plurality, the third subset excluding the first and second subsets and being associated with a vulnerability list, the vulnerability list being a pre-defined list of vulnerable processes determined by a security scanner; and

generating, according to the third subset, a mitigated image for the containerized application.

2. The method of claim 1 , wherein generating the mitigated image further comprises adding a new application layer to the containerized application, the new application layer including a persistent deletion command for the third subset of processes.

3. The method of claim 1 , wherein generating the mitigated image further comprises replacing one or more processes within the third subset with a secured version of the one or more processes.

4. The method of claim 1 , wherein generating the mitigated image further comprises persistently halting the third subset.

5. The method of claim 1 , wherein software is provided as a service to generate the mitigated image.

6. A computer program product for automatic vulnerability mitigation, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a device to cause the device to:

create an image for a containerized application;

identify, from the image, one or more main processes of the containerized application, the one or more main processes comprising a first subset of a plurality of processes of the containerized application;

start, within a sandbox environment, the containerized application;

determine, based on the started containerized application within the sandbox environment, a second subset of processes within the plurality, the second subset including one or more dependent processes associated with and dependent on the one or more main processes comprising the first subset;

determine a third subset of non-dependent processes within the plurality, the third subset excluding the first and second subsets and being associated with a vulnerability list, the vulnerability list being a pre-defined list of vulnerable processes determined by a security scanner; and

generate, according to the third subset, a mitigated image for the containerized application.

7. The computer program product of claim 6 , wherein generating the mitigated image further comprises adding a new application layer to the containerized application, the new application layer including a persistent deletion command for the third subset of processes.

8. The computer program product of claim 6 , wherein generating the mitigated image further comprises replacing one or more processes within the third subset with a secured version of the one or more processes.

9. The computer program product of claim 6 , wherein generating the mitigated image further comprises persistently halting the third subset.

10. The computer program product of claim 6 , wherein software is provided as a service to generate the mitigated image.

11. A system for automatic vulnerability mitigation, the system comprising:

a memory subsystem, with program instructions included thereon; and

a processor in communication with the memory subsystem, wherein the program instructions cause the processor to:

create an image for a containerized application;

identify, from the image, one or more main processes of the containerized application, the one or more main processes comprising a first subset of a plurality of processes of the containerized application;

start, within a sandbox environment, the containerized application;

determine, based on the started containerized application within the sandbox environment, a second subset of processes within the plurality, the second subset including one or more dependent processes associated with and dependent on the one or more main processes comprising the first subset;

determine a third subset of non-dependent processes within the plurality, the third subset excluding the first and second subsets and being associated with a vulnerability list, the vulnerability list being a pre-defined list of vulnerable processes determined by a security scanner; and

generate, according to the third subset, a mitigated image for the containerized application.

12. The system of claim 11 , wherein generating the mitigated image further comprises adding a new application layer to the containerized application, the new application layer including a persistent deletion command for the third subset of processes.

13. The system of claim 11 , wherein generating the mitigated image further comprises replacing one or more processes within the third subset with a secured version of the one or more processes.

14. The system of claim 11 , wherein generating the mitigated image further comprises persistently halting the third subset.