INFRASTRUCTURE-AGNOSTIC NETWORK-LEVEL VISIBILITY AND POLICY ENFORCEMENT FOR CONTAINERS

• Main Authors: Cook, Daniel Richard, Glenn, Matthew Kirby, Fandli, Juraj George, Gupta, Mukesh, McCormick, Thomas Michael, Mishra, Rupesh Kumar, Kirner, Paul James
• Format: Patent
• Language: English
• Published: 16.01.2020
• Subjects: ELECTRIC COMMUNICATION TECHNIQUE; ELECTRICITY; TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHICCOMMUNICATION

An enforcement mechanism on an operating system instance enforces a segmentation policy on a container. A configuration generation module executing in a host namespace of the operating system instance receives management instructions from a segmentation server for enforcing the segmentation policy on a container. The configuration generation module executes in the host namespace to configure a traffic control and monitoring module in a container namespace associated with the container. The traffic control and monitoring module in the container namespace controls and monitors communications to and from the container in accordance with its configuration. By executing a configuration generation module in the host namespace to configure traffic control and monitoring module in the container namespace, the enforcement mechanism beneficially enables robust and lightweight enforcement in a manner that is agnostic to different containerization protocols.