Mitigating Threats to Container-Based Workloads

Abstract

Mitigation of threats to container-based workloads is provided by a process for detecting attacks on a container hosting environment including an active container pool and a spare container pool. The attack poses a potential threat of contamination to hosted containers in the container hosting environment. Based on detecting the attack, the process identifies a time to contamination, which is considered the amount of time it takes for an active container in the active container pool to be compromised as a result of the attack. The process provisions new containers into the spare container pool at a determined rate based on the identified time to contamination, and continuously removes active containers from the active container pool that are servicing the workload while simultaneously deploying spare containers from the spare container pool into the active container pool to replace the removed active containers and take over servicing the workload.

Description

[Technical field]

[0001] The present invention relates to a computer implemented method, a computer system and a computer program product. [Background technology]

[0002] A container is a virtual environment that provides portability to the encapsulated application(s). A variety of container-based virtualization environments are available and widely used. Containers are instantiated from container images by a container engine or host, which provides the runtime environment for the image. Like virtual machines, containers can be stopped and started as needed. Containers are generally more lightweight than virtual machines. Typical practice is to run in a single container only what is needed to run the desired application(s). Summary of the Invention [Problem to be solved by the invention]

[0003] A computer-implemented method, a computer system and a computer program product are provided. [Means for solving the problem]

[0004] The shortcomings of the prior art are overcome and additional advantages are provided through the provision of a computer-implemented method. The method detects an attack on a container hosting environment. The attack poses a potential threat of contamination to a hosted container of the container hosting environment. The container hosting environment includes an active container pool of active containers for servicing a workload and a reserve container pool of reserve containers ready for deployment to the active container pool. The method identifies a time-to-contamination based on detecting the attack. The time-to-contamination is considered to be an amount of time it takes for an active container of the active container pool to become contaminated as a result of the attack. The method provisions new containers to the reserve container pool at a determined rate based on the identified time-to-contamination. Additionally, the method continuously removes active containers from the active container pool that are servicing a workload and simultaneously deploys reserve containers from the reserve container pool to the active container pool to replace the removed active containers and take over servicing the workload.

[0005] Preferably, the present invention provides a method in which the steps of successively removing and simultaneously deploying active containers servicing a workload are performed regardless of whether the active containers being removed have been detected as being compromised as a result of an attack.

[0006] Preferably, the present invention provides a method that includes determining a rate at which to provision new containers in the spare container pool, the determining step being based on a time to contamination, a total number of simultaneously active containers servicing the workload, and an amount of time to spin up and provision new containers in the spare container pool.

[0007] Preferably, the present invention provides a method where the determined rate is determined as Z / Y*X, where Z is the amount of time to spin up and provision a new container in the spare container pool, Y is the time to contamination, X is the total number of concurrent active containers servicing the workload, and the determined rate is the number of containers to provision within each Z period.

[0008] Preferably, the present invention provides a method including the step of temporarily stopping provisioning of new containers to the reserve container pool at a determined rate based on the number of reserve containers in the reserve container pool reaching a threshold at a time, the threshold being based on the number of active containers in the active container pool at the time.

[0009] Preferably, the present invention provides a method further comprising the step of resuming provisioning of new containers to the spare container pool at a determined rate based on the number of spare containers in the spare container pool being equal to the number of active containers in the active container pool.

[0010] Preferably, the present invention provides a method, comprising the steps of setting the identified time to contamination to a pre-specified initial value as the estimated time to contamination based on information about the detected attack, and adjusting the identified time to contamination based on detecting an actual contamination of an active container in the active container pool to an amount of time between (i) a first time the active container was deployed from the reserve container pool to the active container pool and (i) a second time the active container was contaminated as a result of the attack.

[0011] Preferably, the present invention provides a method further comprising the step of monitoring, during successive removals and simultaneous deployments, whether active containers of the active container pool become contaminated as a result of a detected attack.

[0012] Preferably, the present invention provides a method including a step of increasing a rate at which active containers are removed from the active container pool by successively removing them based on detecting in the monitoring step that an active container in the active container pool becomes contaminated as a result of a detected attack, the increasing step increasing the rate to be equal to the determined rate at which new containers are provisioned in the reserve container pool.

[0013] Preferably, the present invention provides a method including: (i) detecting, in the monitoring step, that an active container in the active container pool has not been contaminated as a result of a detected attack, where detecting that the active container has not been contaminated as a result of the detected attack is based on configuring the active container with a remediation for the detected attack; and (ii) reducing the rate at which active containers are removed from the active container pool by successive removals based on at least one selected from the group consisting of: detecting that the attack has ceased.

[0014] Preferably, the present invention provides a method comprising the step of performing a graceful shutdown of the active container being removed, the graceful shutdown including saving a state of the active container being removed, wherein a spare container deployed to replace the active container being removed resumes processing of the workload using the saved state of the removed active container.

[0015] Further provided is a computer system including a memory and a processor in communication with the memory, the computer system configured to execute a method. The method detects an attack on a container hosting environment. The attack poses a potential threat of contamination to a hosted container of the container hosting environment. The container hosting environment includes an active container pool of active containers for servicing a workload and a reserve container pool of reserve containers ready for deployment to the active container pool. The method identifies a time to contamination based on detecting the attack. The time to contamination is considered as an amount of time it takes for an active container of the active container pool to be infected as a result of the attack. The method provisions new containers to the reserve container pool at a determined rate based on the identified time to contamination. Additionally, the method continuously removes active containers from the active container pool that are servicing a workload and simultaneously deploys reserve containers from the reserve container pool to the active container pool to replace the removed active containers and take over servicing the workload.

[0016] Preferably, the present invention provides a computer system in which the steps of successively removing and simultaneously deploying active containers servicing a workload are performed regardless of whether the active containers being removed have been detected as being contaminated as a result of an attack.

[0017] Preferably, the present invention provides a computer system, wherein the method includes determining a rate at which to provision new containers in a spare container pool, the determining step being based on a time to contamination, a total number of concurrently active containers servicing the workload, and an amount of time to spin up and provision new containers in the spare container pool, the determined rate being determined as Z / Y*X, where Z is the amount of time to spin up and provision new containers in the spare container pool, Y is the time to contamination, X is the total number of concurrently active containers servicing the workload, and the determined rate is the number of containers to provision within each Z period.

[0018] Preferably, the present invention provides a computer system, wherein the identified time to contamination is set to a pre-specified initial value as the estimated time to contamination based on information about the detected attack, and the method includes the step of adjusting, based on detecting an actual contamination of an active container in the active container pool, the identified time to contamination to an amount of time between (i) a first time that the active container was deployed from the reserve container pool to the active container pool and (ii) a second time that the active container was contaminated as a result of the attack.

[0019] Preferably, the present invention provides a computer system, the method comprising: monitoring whether an active container in the active container pool becomes contaminated as a result of a detected attack while simultaneously deploying with successive removal; and reducing a rate at which active containers are removed from the active container pool by successive removal based on at least one selected from the group consisting of: (i) detecting in the monitoring step that an active container in the active container pool is not contaminated as a result of the detected attack, where detecting that the active container is not contaminated as a result of the detected attack is based on configuring the active container with a fix for the detected attack; and (ii) detecting that the attack has ceased.

[0020] The present invention further provides a computer program product, the computer program product including a computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit, for performing a method. The method detects an attack on a container hosting environment, the attack resulting in a potential threat of contamination to a hosted container of the container hosting environment. The container hosting environment includes an active container pool of active containers for servicing a workload and a reserve container pool of reserve containers ready for deployment to the active container pool. The method includes identifying a time to contamination based on detecting the attack, the time to contamination being considered as an amount of time it takes for an active container of the active container pool to be infected as a result of the attack. The method provisions new containers to the reserve container pool at a determined rate based on the identified time to contamination. Additionally, the method continuously removes active containers from the active container pool that are servicing a workload, while simultaneously deploying reserve containers from the reserve container pool to the active container pool to replace the removed active containers and take over servicing the workload.

[0021] Preferably, the present invention provides a computer program product, in which the step of successively removing and simultaneously deploying active containers servicing a workload is performed regardless of whether the active containers to be removed are detected as being contaminated as a result of an attack.

[0022] Preferably, the present invention provides a computer program product, wherein the method includes determining a rate at which to provision new containers in the spare container pool, the determining step being based on a time to contamination, a total number of concurrently active containers servicing the workload, and an amount of time to spin up and provision new containers in the spare container pool, the determined rate being determined as Z / Y*X, where Z is the amount of time to spin up and provision new containers in the spare container pool, Y is the time to contamination, X is the total number of concurrently active containers servicing the workload, and the determined rate is the number of containers to provision within each Z period.

[0023] Preferably, the present invention provides a computer program product, wherein the identified time to contamination is set to a pre-specified initial value as the estimated time to contamination based on information about the detected attack, and the method includes the step of adjusting, based on detecting an actual contamination of an active container in the active container pool, the identified time to contamination to an amount of time between (i) a first time when the active container was deployed from the reserve container pool to the active container pool and (ii) a second time when the active container was contaminated as a result of the attack.

[0024] Additional features and advantages are realized through the concepts described herein.

[0025] The aspects described herein are particularly pointed out and distinctly claimed at the end of this specification as examples of the claims. The above and other objects, features and advantages of the present invention will become apparent from the following detailed description taken in conjunction with the accompanying drawings. [Brief description of the drawings]

[0026] [Figure 1] FIG. 1 illustrates an exemplary environment for incorporating and using aspects described herein. [Diagram 2] 1 illustrates a conceptual diagram of an automated response to detection of a threat to a cloud container according to aspects described herein. [Diagram 3] 1 illustrates an example process for mitigating threats to container-based workloads according to aspects described herein. [Figure 4] 1 illustrates an example process for mitigating threats to container-based workloads according to aspects described herein. [Diagram 5] 1 illustrates an example process for mitigating threats to container-based workloads according to aspects described herein. [Figure 6] 1 illustrates an example of a computer system and related devices incorporating and / or using aspects described herein. [Figure 7] 1 illustrates a cloud computing environment according to an embodiment of the present invention. [Figure 8] 1 illustrates an abstraction model layer according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0027] Most attacks against vulnerable systems take only minutes to execute and typically require a patch or workaround to be applied to a running node or container to mitigate the impact of the attack. Existing methods of remediating compromised systems typically involve downtime for applications or degraded performance while the system is patched or taken down for reconstruction. In many cases, an attacker can maintain access to a compromised system for some time before it is remediated, or the attacker can effectively reinfect the system or infect a new system, or both, while administrators are working to remediate the threat.

[0028] Containers offer a unique opportunity to change this paradigm. Described herein is an approach for replacing active containers with newly provisioned containers at a rate that exceeds the rate at which the active containers can be compromised or contaminated by detected threats. This allows the impact of the attack to be mitigated until a permanent fix can be made. As described, an attack is detected as posing a potential or perceived threat of contamination to a hosted container in the container environment. With reason to believe there is an ongoing attack, an estimated or actual time for the attack to penetrate the environment and reach the target container is determined. This provides knowledge of the rate at which new containers should be provisioned on an ongoing basis to replace existing containers identified as being compromised or facing an existing threat of contamination.

[0029] Aspects take advantage of quick "spin-up" and "spin-down" times or containers and their "vanilla" state upon provisioning in presenting an approach to mitigate attacks on vulnerable systems until a permanent patch or workaround is deployed. In some embodiments, containers are cycled quickly, meaning that they have a relatively short lifespan before being provisioned into an active pool and replaced therein with other vanilla containers. In some embodiments, after a container is active in an active container pool handling traffic or other workload services for a set amount of time, it is removed from the pool of active containers and replaced by a newly provided "clean" container. Due to the immutability of containers, newly provisioned containers can be provisioned based on a known good configuration. Cycling active containers can be done continuously, i.e., continuously over time, keeping the active container pool clean from compromise and functioning normally.

[0030] Containers in the active pool may be stateful, stateless, or a combination. Running stateless containers allows them to be abruptly terminated and replaced with the next container without persisting state. Alternatively, if a container contains state that should be preserved, this may be written (stored) before bringing the container down. Additionally or alternatively, some or all containers that are removed from the active state may be "gracefully" shut down / deprovisioned, giving them the opportunity to persist anything they need.

[0031] Additionally, some embodiments may capture a copy of an image of the container before deprovisioning the container, which may be used for future forensic analysis or other purposes, if desired.

[0032] Thus, aspects leverage a container deployment model to reduce the attack surface by reducing the time that containers are active. A process continuously cycles active containers to bring down compromised containers and / or to prevent containers from being compromised in the first place. In embodiments, actively in use containers are cycled quickly enough that they are in use for a short enough time before an attack can compromise (infect, infiltrate, modify, etc.) the container.

[0033] A contamination time calculation is disclosed and used to optimize the amount of time a container remains active and unencroached. Excess capacity calculations are also used to determine the number of ready containers on hand.

[0034] 1 illustrates an exemplary environment 100 for incorporating and using aspects described herein. Environment 100 is an example container environment. Exemplary container offerings include OpenShift® offered by Red Hat, Inc. (Raleigh, NC, OPENSHIFT is a registered trademark thereof) and Docker® (offered by Docker Inc., San Francisco, CA, USA, DOCKER is a registered trademark thereof), among others.

[0035] The environment of FIG. 1 illustrates a container environment, and examples are presented herein in the context of container technology, however, it should be understood that aspects described herein also work with other types of virtual environment technologies, such as virtual machines (VMs) running on a virtual machine (VM) host.

[0036] 1, the environment 100 includes a container host 102 that provides facilities for at least the execution of containers and hosting of a container pool, in some cases including a repository / registry for container images. The container host 102 is itself hosted in a cloud environment 104 or other network infrastructure. In one embodiment, the container host(s) 102 host a ready / spare container pool of containers and an active use container pool of containers. A control system 106 communicates with the container host(s) 102 via the Internet or other network(s) and manages the instantiation / provisioning of containers from container images onto the container host, as well as the deployment and removal of containers to and from various pools.

[0037] During container execution, the container(s) may be exposed to external threats 110. The threats may come in the form of attacks on the container hosting environment / container host 102.

[0038] 1 form a wired or wireless network(s) of devices, with communication between the devices occurring via wired or wireless communication links 112 for communicating data between the devices. Figure 1 is merely one example of an environment for incorporating and using aspects described herein, and many other examples that are compatible with the capabilities described herein are possible and contemplated.

[0039] In a typical example, the control system 106 reads a configuration 108 for provisioning containers on the container host(s) 102. The configuration may dictate characteristics such as how frequently to provision new containers and how frequently to quarantine / deprovision existing actively in use container(s). The control system 106 may identify a container image from which to initiate container instantiation and place it in an appropriate pool. In a particular example, a container is provisioned in a ready / spare pool, which is a pool that holds instantiated containers that are ready but not actively in use to service a workload. Initiating container instantiation may include sending a call or other command from the control system 106 to the container host 102 or its management system. The call / command may instruct the container host to instantiate a container on the container host from the container image. In some examples, the container host retrieves the image from a repository that is local or remote to the container host. The configuration 108 may specify parameters to use in instantiating one or more containers.

[0040] The control system 106 also controls the deprovisioning / removal of active containers from the active container pool, placing them in a deprovisioned or quarantined state where they are no longer actively processing workloads. In some examples, a deprovisioned container is terminated and its resources are returned to the host's available resource pool.

[0041] In some examples, the control system 106 is or includes a provision / quarantine engine as discussed herein.

[0042] Configuration 108 refers to processes, instructions, information, commands, or specifications, or combinations thereof, that direct the provisioning and deprovisioning of containers and their movement from a reserve pool to an active pool in accordance with aspects described herein.

[0043] The example of FIG. 1 illustrates several components implemented by / on one or more computer systems, eg, software executing thereon.

[0044] 2 is a conceptual diagram of an automated response to detection of a threat to a cloud container according to aspects described herein. 202 represents a collection of containers and their progression from provisioning 204 to a reserve / standby container pool 206 of reserve containers ready for deployment. From there, the containers are deployed for active use to an active container pool 208 of containers servicing (e.g., processing) a workload(s). According to aspects described herein, the containers are removed from the active container pool 208 to a quarantine / deprovision area 210 and replaced by reserve containers.

[0045] Further components of FIG. 2 include a vulnerability scanner / threat detector 212, a taint time calculator 216, a database 214 of estimated taint times for each of a number of vulnerabilities, an excess capacity calculator 218, and a provision / quarantine engine 220, which manages container provisioning, container quarantine / deprovisioning, and movement of containers between pools in collection 202.

[0046] In an exemplary sequence of events, at "1", the threat detector 212 performs real-time scanning and threat detection within the environment, including detection of threats to containers in the active container pool 208. The threat detector 212 detects an attack against the container hosting environment. Detection of an attack may be recognized or triggered based on any desired factor or factors. What is considered an attack that triggers later aspects of the sequence may be configurable. This may depend on factors such as the desired security level, the sensitivity of the information processed by the container, the uniqueness of the hosting environment, the assessment level of the technology involved or ongoing threat activity, etc. In general, a detected attack is considered to pose a potential or actual threat of contamination to the hosted containers of the container hosting environment.

[0047] Threat detection may therefore detect threats that may affect an active container and detect the actual contamination of the container. As part of this, the time of contamination or detection of the threat may be sensed and recorded. In some embodiments, this detection includes identifying the specific threat and capturing information about the threat, such as its attack vector, affected ports / addresses, data files, process(es), etc. The threat detector passes the relevant information about the threat to the contamination time calculator 216.

[0048] At "2" in the sequence, the contamination time calculator receives information from the threat detector 212 and consults the database 214 for an estimate of the time to contamination, e.g., an estimate of the time it would take for a threat to contaminate a clean container. In one example, this database is implemented as a table of approximate breach times for various threats. If the threat is not sufficiently identified, e.g., is new or unrecognized, a default estimate of breach time may be used. An exemplary default breach time used is 30 seconds.

[0049] The database provides an estimated minimum time to compromise, which refers to an estimate of the time it takes for an attack to reach active containers and compromise them. Some attacks may be detected before the actual compromise of the target actively using container. There may be a window of time between the initial break-in (at the front-end) and the compromise of the back-end. For example, an attack at a front-end component (container or not) may signal that an attack is present and that a threat is posed to a back-end component (e.g., a back-end container serving a workload). The time to initial compromise in this example may be taken as an estimate of the time from the time the attack is detected to the time the container is compromised. The compromise time estimate may be the estimated amount of time it takes for an attack to break through the front-end and compromise the back-end. This is regardless of whether or not the back-end is actually compromised or has been compromised.

[0050] The contamination time calculator can then monitor ("3") new containers that have been moved from "prepared / reserve" to "active use" and have determined the actual contamination timing for them (if the threat would actually contaminate them) to determine the actual minimum time that a vanilla container could be compromised. This can be used to refine the minimum contamination time estimate from "2". If the observed minimum time is less than the estimated time indicated in the database, any observed minimum contamination time may be stored in the database to refine the table-based estimate.

[0051] In this manner, the calculator 216 can monitor the active container pool 208, monitor when containers are deployed into active use, and identify how long it will take for an active container to be compromised based on monitoring the active pool and / or receiving indications from the threat detector 212.

[0052] Thus, based on detecting the attack, a time to contamination is identified. The time to contamination is taken as the time until an active container in the active container pool is contaminated as a result of the attack. In some examples, as described above, the identified time to contamination is set to an initial value, which is pre-specified and obtained from a database as an estimated time to contamination based on information about the detected attack provided by the threat detector. This initial time to contamination may then be adjusted based on detecting an actual contamination of an active container in the active container pool, i.e., to an amount of time between a first time (when the active container is deployed from the reserve container to the active container pool) and a second time (when the active container is contaminated as a result of the attack).

[0053] When a threat is detected, aspects described herein initiate a process to proactively remove active use containers from the active container pool 208 to a "quarantine / deprovision" pool. Meanwhile, new containers are provisioned from the reserve / spare pool 206 to the active use (pool 208) to replace the processing resources provided by the previous active use container that was deprovisioned. Containers deployed in the active use pool are deployed from the reserve / spare pool 206. The process determines a rate at which new containers are provisioned to the spare containers 206 based on the identified time to contamination, such that a desired number of containers are ready and stocked to be provisioned to the active use 208 at a rate sufficient to prevent containers in the active container pool 208 from being subsequently compromised. This determination of the rate at which new containers are provisioned and reserved is accomplished by the excess capacity calculator 218, which obtains (at "4") the time to contamination from the contamination time calculator 216. It also takes as input the total number of active use containers required, i.e., the number of concurrent active use containers that are deemed sufficient to service the workload, and the spin-up time for the containers. This information may be provided by the user, the engine 220, or any other source. The excess capacity calculator 218 then determines the rate at which to spin up / provision new containers in the ready / spare pool 206 to ensure that enough containers are spun up and waiting in a "ready / spare" state.

[0054] In some embodiments, identical "all-purpose" containers are used so that their spin-up times are the same. In embodiments that use different groups of specialized containers with different attributes so that their spin-up times vary, the sequence of Figure 2 can be run for each such group to determine their respective time-to-contamination and excess capacity calculations, and to cycle through the actively used containers in each group.

[0055] The rate at which new containers are provisioned in the spare container pool may be based on the time to contamination, the total number of concurrently active containers for servicing the workload, and the time to spin up and provision new containers in the spare container pool. -Assume that all actively using containers can be attacked simultaneously (worst case); -Assume there are X number of concurrent active use containers required to satisfy the load; -Set the time to minimum contamination Y: -Set spinup time Z for a container: Then, X number of containers must exist in a reserve / ready state ready to be deployed for active use for up to a period of time Y, such that the reserve containers can replace all actively used containers, assuming the worst case that all actively used containers are infected within a minimum time Y.

[0056] Therefore, the formula Z / Y*X gives the number of nodes that are spun up every Z seconds, ie, the determined rate.

[0057] As a concrete example, assume the spin-up time is 10 seconds, the time to taint is 20 seconds, and 10 active nodes (containers) are required to service the workload. Then the rate is 10 / 20*10=5. This is the number of nodes that spin up every 10 seconds. This results in a pool of 10 spare nodes every 20 seconds that can replace the 10 active nodes that have been tainted.

[0058] Thus, based on the contamination time (provided to the excess capacity calculator from the contamination time calculator at "4") and other parameters including the number of active containers required and the spin-up time, the excess capacity calculator 218 determines how many containers to spin up and how often to do so. Each parameter in the formula may come from any suitable entity. For example, the provision / quarantine engine 220 may have knowledge about the spin-up time based on its provisioning activities. The number of actively used containers required may be specified by the user, for example, or dictated by a workload manager or other component, or both.

[0059] The provision / quarantine engine 220 may handle the tasks of continuously provisioning new containers, moving them to a ready / reserve state, then to active use, moving them to a quarantine state (upon or prior to contamination), and then deprovisioning them. Thus, "6" in FIG. 2 refers to continuously removing active containers from the active container pool that are servicing a workload, and simultaneously deploying spare containers from the spare container pool to the active container pool to replace the removed active containers and take over servicing the workload. Removing one or more containers from the active container pool 208 may be performed upon observing actual contamination of one or more containers. Alternatively, removing active container(s) servicing a workload in the active container pool and deploying new ones in the active container pool may be performed regardless of whether the removed active container(s) are detected to be contaminated. Meanwhile, the engine 220 may provision new containers in the spare container pool 206 at a determined rate, i.e., a rate determined by the excess capacity calculator 218. In this manner, provisioning / deprovisioning can operate at least in part based on slack time calculation component 218. In some embodiments, removal of containers from the active usage pool and deployment of new containers to the active usage pool is performed at a determined rate at which new containers are provided to the reserve / reserve, such that actual compromise of containers in the active usage pool is not observed because containers are cycled through faster than attacks can contaminate them.

[0060] In some embodiments, when removing an active container to the quarantine / deprovision state, engine 220 may force the container to shut down "gracefully." This is optional. In some examples, it is based on whether the container has state to preserve. If so, and a graceful shutdown is requested, the state of the active container being removed may be preserved. Additionally, a spare container deployed to replace the active container being removed can resume workload processing using the preserved state of the active container being removed, if desired.

[0061] The ongoing process may further include monitoring whether an active container in the active container pool is actually tainted as a result of the detected attack as the container is successively removed from active use and replaced with a new container that is simultaneously deployed into active use. If not, this may indicate an opportunity to slow down the container cycling, a principle that may reduce power and other resource consumption. If the container is tainted, this may signal that cycling should be sped up, as well as the rate at which new containers are provisioned to the ready / reserve state. Thus, based on detecting, by monitoring, that an active container in the active container pool is tainted as a result of the detected attack, the process may increase the rate at which active containers are removed from the active container pool by successively removing them. This rate may be increased, for example, to be equal to the determined rate of provisioning new containers to the reserve container pool. This may allow for faster cycling. Assuming the time to contamination is accurate, then eventually the active use containers will not be tainted by the threat. However, if an active container is compromised despite cycling at the rate determined by the excess capacity calculator, this means that contamination is occurring faster than the minimum time to contamination determined in 218. In this case, the threat detector 212 or contamination time calculator will pick a lower minimum time to contamination and provide it to the excess capacity calculator 218 to update the rate at which spare containers are provisioned. In addition, the new minimum time to contamination may be stored in the database 214, if desired. To meet the new determined rate, the cycle rate at which active containers are removed and new ones deployed may be increased (i.e., cycled faster). The faster cycling will eradicate contamination from the active usage pool.

[0062] In contrast, the cycle rate, i.e., the rate at which active containers are removed from the active container pool and replaced with new containers, may be decreased (i.e., slowed down) in various circumstances. One such circumstance is when monitoring whether active containers in the active container pool have actually been compromised detects that active containers in the active container pool are not being compromised (or the rate of compromise has slowed down) as a result of a detected attack. This may be detected, for example, when newly provisioned and deployed active containers are configured with a fix for the detected attack. Additionally or alternatively, the cycle rate may be decreased based on detecting that the attack has ceased.

[0063] If desired, the cycle rate may be increased or decreased by a preset amount, or the cycle rate may be ceilinged or floored, or both. For example, the cycle rate may be slowed down until a threshold rate is reached and / or contamination is observed. If contamination is observed, the cycle rate may be increased until contamination is not observed for at least a predetermined period of time.

[0064] If containers are not being attacked and / or compromised as quickly as in the worst-case scenario, the process may stop, for example, provisioning new nodes to the reserve pool at a pre-set "cut-off" point, where the number of containers in the reserve / spare pool 206 reaches or exceeds the number of active nodes at a pre-determined ratio. Provisioning to the reserve / spare pool 206 can then be resumed when the number of containers therein reaches some number relative to the number of containers in the active usage pool 208, for example when it becomes equal to the number of active containers.

[0065] Thus, based on the number of spare containers in the spare container pool reaching a threshold at some point in time, engine 220 may temporarily stop provisioning new containers to the spare container pool at a determined (i.e., determined by excess capacity calculator 218) rate. The threshold may be based on the number of active containers in the active container pool at that time, e.g., based on the ratio of the number of reserve / spare containers to the number of active containers. This rate of provisioning may not be equal to the cycle rate (removal from and deployment to active pool 208), which may result in excess reserve containers. Pausing the provisioning of new containers may prevent the spare pool from becoming overgrown. Provisioning of spare containers to the spare container pool may then be resumed later, e.g., at the determined rate or at another rate, e.g., based on the number of spare containers in the spare container pool shrinking to be equal to the number of active containers in the active container pool.

[0066] Aspects described herein present a model for cycling containers to mitigate the contamination of containers in the face of a threat and / or avoid contamination altogether. This differs from an approach that simply recognizes contamination and cleans the affected environment and / or installs preventative measures. It also differs from an approach that simply restarts a compromised container to reset it, where the attack simply persists and will be resumed for the container as soon as it is back online.

[0067] 3-5 illustrate an example process for mitigating threats to container-based workloads according to aspects described herein. In some examples, the process is performed by one or more computer systems as described herein, which may include a control system, a computer system of or connected to the container hosting environment, or one or more other computer systems, or a combination thereof.

[0068] First, referring to Figure 3, the process begins by detecting 302 an attack on the container hosting environment. In one example, the detection occurs upon breaching a front-end component. The attack may be recognized as posing a potential threat of compromise to containers hosted in the container hosting environment. The container hosting environment includes an active container pool of active containers for servicing workloads and a spare container pool of spare containers ready for deployment to the active container pool.

[0069] Based on detecting the attack, the process identifies (304) a time to contamination. The time to contamination is obtained as an amount of time it takes for an active container in the active container pool to become contaminated as a result of the attack. In some examples, this time to contamination is obtained at least initially as an estimate. The identified time to contamination may be set to an initial value that is pre-specified as the estimated time to contamination and identified based on information about the detected attack. The process may further include, based on detecting an actual contamination of an active container in the active container pool, adjusting the identified time to contamination to be an amount of time between a first time that the active container was deployed from the reserve container pool to the active container pool and a second time that the active container was contaminated as a result of the attack.

[0070] The process continues by determining a rate at which to provision new containers into the reserve container pool based on the identified time to contamination, and by provisioning new containers into the reserve container pool at this determined rate. Figure 4, described below, presents an exemplary process for determining such a rate.

[0071] 3 continues at 310, where spare containers from the spare container pool are deployed into the active container pool to replace the removed active containers and take over servicing the workload. The removal and deployment of active containers from the active container pool that are servicing a workload may be performed regardless of whether the active containers being removed were actually compromised or detected to be compromised, or both, as a result of an attack.

[0072] The process continues by monitoring (312) whether active containers in the active container pool become tainted as a result of the detected attack while simultaneously successively removing and deploying, and optionally adjusting the rate of removal from and deployment to the active pool. For example, adjusting may increase the rate at which active containers are removed from the active container pool by successive removal based on detecting that an active container in the active container pool becomes tainted as a result of the detected attack by monitoring. Increasing may increase the rate to be equal to a determined rate at which new containers are provisioned, for example, in the reserve container pool. Additionally or alternatively, the process may decrease the rate at which active containers are removed from the active container pool by successive removal based, for example, on (i) detecting that an active container in the active container pool is not tainted as a result of the detected attack, where detecting that the active container is not tainted as a result of the detected attack is based on configuring the active container with a fix for the detected attack, or (ii) detecting that the attack has ceased, or both.

[0073] In some embodiments, the process may further include performing a graceful shutdown of the removed active container, the graceful shutdown including preserving a state of the removed active container, and a spare container deployed to replace the removed active container resumes processing of the workload using the preserved state of the removed active container.

[0074] 4 shows an exemplary process for determining a rate at which to provision new containers in the spare container pool. The determination may be based on the time to contamination, the total number of concurrently active containers servicing the workload, and the amount of time to spin up and provision new containers in the spare container pool. Thus, the process obtains these values ​​as Y, X, and Z, respectively (320). The process then determines the rate as Z / Y*X=number of containers to provision in each Z period (322).

[0075] FIG. 5 illustrates an exemplary process performed as part of continuously removing active containers servicing workloads from the active container pool while simultaneously deploying spare containers to the active container pool (310). The process monitors the number of containers provisioned in the reserve / spare container pool (330). The process determines whether the number of spare containers in the spare container pool reaches a threshold value at that time (332). In one embodiment, the threshold value is based on the number of active containers at that time in the active container pool. Based on the number of spare containers in the spare container pool reaching the threshold value at that time (332, YES), the process temporarily stops provisioning new containers to the spare container pool at the determined rate. The process returns from 334 to 330 to continue monitoring the number of spare containers. If it is determined at 332 that the number of reserve containers is at or above the threshold (332, NO), the process determines whether the number of spare containers in the spare container pool is equal to the number of active containers in the active container pool (366). If so (336,Y), the process resumes provisioning new containers into the reserve container pool at the determined rate. If it is determined from 338 or at 336 that the number of reserve containers has not decreased to equal the number of active containers (336,N), the process returns to 330 to continue monitoring.

[0076] Various embodiments are provided, and modifications may be made without departing from the scope of the claims.

[0077] The methods described herein may be performed by one or more computer systems, either alone or in concert. FIG. 6 illustrates an example of such a computer system and associated devices incorporating and / or using aspects described herein. The computer system may be referred to herein as a data processing device / system, a computing device / system / node, or simply a computer. The computer system may be based on one or more of a variety of system architectures and / or instruction set architectures, such as those provided by International Business Machines Corporation (Armonk, NY, USA) or Intel Corporation (Santa Clara, CA, USA), for example.

[0078] 6 illustrates a computer system 400 in communication with external device(s) 412. Computer system 400 includes one or more processor(s) 402, e.g., central processing units (CPUs). The processor includes functional components used to execute instructions, such as functional components that fetch program instructions from locations such as a cache or main memory, decode and execute the program instructions, access memory for instruction execution, and write results of executed instructions. Processor 402 may also include register(s) used by one or more functional components. Computer system 400 also includes memory 404, input / output (I / O) devices 408, and I / O interfaces 410, which may be coupled to processor(s) 402 via one or more buses and / or other connections. The bus connection may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example, and without limitation, such architectures include an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0079] The memory 404 may include, by way of example, a main or system memory (e.g., random access memory), storage device(s) such as hard drive(s), flash media, or optical media, or a cache memory used to execute program instructions. The memory 404 may include, for example, a cache, such as a shared cache, which may be coupled to a local cache (e.g., including an L1 cache, an L2 cache, etc.) of the processor(s) 402. Additionally, the memory 404 may be or may include at least one computer program product having a set (e.g., at least one) of program modules, instructions, code, etc., configured to perform the functions of the embodiments described herein when executed by one or more processors.

[0080] The memory 404 may store other computer programs 406, such as an operating system 405 and one or more computer programs / applications that execute to perform aspects described herein. In particular, the programs / applications may include computer readable program instructions that may be configured to perform the functions of embodiments of the aspects described herein.

[0081] Examples of I / O devices 408 include, but are not limited to, microphones, speakers, global positioning system (GPS) devices, cameras, lighting, accelerometers, gyroscopes, magnetometers, sensor devices configured to sense light, proximity, heart rate, temperature of the body or surroundings or both, blood pressure, or skin resistance, or combinations thereof, and activity monitors. The I / O devices may be incorporated into the computer system as shown, although in some embodiments the I / O devices may be considered external devices (412) coupled to the computer system via one or more I / O interfaces 410.

[0082] The computer system 400 may communicate with one or more external devices 412 through one or more I / O interfaces 410. Exemplary external devices include a keyboard, a pointing device, a display, or any other device or combination that allows a user to interact with the computer system 400. Other exemplary external devices include any device that allows the computer system 400 to communicate with one or more other computing systems or peripheral devices such as a printer. Network interfaces / adapters are exemplary I / O interfaces for allowing the computer system 400 to communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), or a public network (e.g., the Internet), or combinations thereof, providing communication with other computing devices or systems, storage devices, and the like. Ethernet-based (e.g., Wi-Fi®) interfaces and BLUETOOTH® (BLUETOOTH® is a registered trademark of Bluetooth SIG, Inc., Kirkland, Wash., USA) adapters are just examples of currently available types of network adapters for use in computer systems.

[0083] Communication between the I / O interface 410 and the external device 412 may occur via wired and / or wireless communication link(s) 411, such as an Ethernet-based wired or wireless connection. Examples of wireless connections include cellular, Wi-Fi, Bluetooth, proximity-based, near-field, or other types of wireless connections. More generally, the communication link(s) 411 may be any suitable wireless and / or wired communication link(s) for communicating data.

[0084] The specific external device(s) 412 may include one or more data storage devices that may store one or more programs, one or more computer readable program instructions or data, or a combination thereof. The computer system 400 may include or be coupled to, and / or communicate with (e.g., as a computer system external device) a removable volatile / non-volatile computer system storage medium. For example, it may include or be coupled to, and / or communicate with, a removable non-volatile magnetic medium (typically referred to as a "hard drive"), a magnetic disk drive for reading and writing to a removable non-volatile magnetic disk (e.g., a "floppy disk"), or an optical disk drive for reading and writing to a removable non-volatile optical disk, such as a CD-ROM, DVD-ROM, or other optical medium.

[0085] The computer system (400) is capable of operation with numerous other general purpose or special purpose computing system environments or configurations. Computer system 400 may take a variety of forms, some well-known examples of which include, but are not limited to, personal computer (PC) system(s), server computer system(s) such as message server(s), thin client(s), thick client(s), workstation(s), laptop(s), handheld device(s), smartphone(s), mobile device(s) / system(s) such as tablet(s) and wearable device(s), multiprocessor system(s), microprocessor-based system(s), telephony device(s), network equipment(s) (e.g., edge appliance(s), virtualization device(s), storage controller(s), set-top box(es), programmable consumer electronics(s), network PC(s), minicomputer system(s), mainframe computer system(s), and distributed cloud computing environment(s) including any of the above systems or devices.

[0086] Although this disclosure includes a detailed description of cloud computing, it should be understood that implementation of the teachings detailed herein is not limited to a cloud computing environment. Rather, embodiments of the invention may be implemented in conjunction with any other type of computing environment now known or hereafter developed.

[0087] Cloud computing is a model of service delivery that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with a service provider. The cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0088] The characteristics are as follows:

[0089] On-Demand Self-Service: Cloud consumers can unilaterally provision computing power, such as server time and network storage, as they need it automatically, without the need for human interaction with the service provider.

[0090] Broadband Network Access: Capabilities are available over the network and accessed via standard mechanisms that facilitate use by heterogeneous thin-client or thick-client platforms (eg, mobile phones, laptops, PDAs).

[0091] Resource Pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where various physical and virtual resources are dynamically allocated and reallocated according to demand. Consumers generally have no control or knowledge of the exact location of the resources provided, but there is a sense of location independence in the sense that they can specify location at a higher level of abstraction (e.g. country, state, or data center).

[0092] Rapid Elasticity: Capacity can be rapidly and elastically, in some cases automatically, provisioned and quickly scaled out, and rapidly released and quickly scaled in. To the consumer, the provisioned available capacity often appears externally unlimited, and any amount can be purchased at any time.

[0093] Measured Services: Cloud systems automatically control and optimize resource usage by utilizing metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, number of active users). Resource usage is monitored, controlled and reported, providing transparency to both providers and consumers of the services being used.

[0094] The service model is as follows:

[0095] Software as a Service (SaaS): The capability offered to the consumer is to use a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g. web-based email). The consumer does not manage or control the underlying infrastructure, including networks, servers, operating systems, storage, or even individual application capabilities with the potential exception of limited user-specific application configuration settings.

[0096] Platform as a Service (PaaS): The ability offered to a consumer is to deploy consumer-created or acquired applications, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but does have control over the deployed applications and possibly the configuration of the application hosting environment.

[0097] Infrastructure as a Service (IaaS): The capability provided to the consumer is to provide processing, storage, networking, and other basic computing resources onto which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does have control over the operating systems, storage, deployed applications, and possibly limited control over select networking components (e.g., host firewalls).

[0098] The deployment model is as follows:

[0099] Private Cloud: The cloud infrastructure is used exclusively for one organization. It may be managed by the organization or a third party and can be on-premise or off-premise.

[0100] Community Cloud: Cloud infrastructure is shared by several organizations to support a specific community with common concerns (e.g., mission, security requirements, policy and compliance considerations). It may be managed by the organization or a third party and can exist on-premise or off-premise.

[0101] Public Cloud: The cloud infrastructure is available to the general public or to large industry entities and is owned by organizations that sell cloud services.

[0102] Hybrid Cloud: A cloud infrastructure is a blend of two or more clouds (private, community or public) that remain unique entities but are joined by standardized or proprietary technologies that allow data and application portability (e.g. cloud bursting for load balancing between clouds).

[0103] Cloud computing environments are service-oriented with an emphasis on statelessness, low coupling, modularity and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0104] Referring now to FIG. 7, an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers may communicate, such as, for example, a PDA or mobile phone 54A, a desktop computer 54B, a laptop computer 54C, or an automobile computer system 54N, or combinations thereof. The nodes 10 may communicate with each other. They may be physically or virtually grouped (not shown) in one or more networks, such as private, community, public, or hybrid clouds, as described above, or combinations thereof. This allows the cloud computing environment 50 to provide infrastructure, platform, or software, or combinations thereof, as a service, for which the cloud consumer does not need to maintain resources on a local computing device. The types of computing devices 54A-54N shown in FIG. 7 are for illustrative purposes only, and it will be understood that the computing nodes 10 and the cloud computing environment 50 may communicate with any type of computerized device over any type of network, network addressable connection (e.g., using a web browser), or both.

[0105] Referring now to Figure 8, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 7) is shown. It is understood in advance that the components, layers and functions shown in Figure 8 are for illustrative purposes only and that embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0106] Hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframe 61, servers based on RISC (Reduced Instruction Set Computer) architecture 62, servers 63, blade servers 64, storage devices 65, and networks and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0107] The virtualization layer 70 provides an abstraction layer from which examples of virtualized entities such as virtualized servers 71, virtualized storage 72, virtualized networks including virtual private networks 73, virtualized applications and operating systems 74, and virtual clients 75 are provided.

[0108] In one example, management layer 80 may provide the functions described below. Resource provisioning 81 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 82 provides tracking of costs as resources are utilized within the cloud computing environment and billing or invoicing for consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, as well as protection for data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides allocation and management of cloud computing resources to meet required service levels. Service level agreement (SLA) planning and fulfillment 85 provides pre-allocation and procurement of cloud computing resources in anticipation of future demand in accordance with SLAs.

[0109] The workload layer 90 provides examples of functionality for which cloud computing environments are utilized. Examples of workloads and functions provided from this layer include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instructional delivery 93, data analytics processing 94, transaction processing 95, and container threat mitigation 96.

[0110] The present invention may be a system, method or computer program product, or combination thereof, at any possible level of technical detail. The computer program product may include a computer readable storage medium having computer readable program instructions thereon for causing a processor to perform aspects of the present invention.

[0111] A computer readable storage medium may be a tangible device that holds and stores instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. An illustrative enumeration of more specific examples of computer readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves with recorded instructions, and any suitable combination of the above. Computer-readable storage media, as used herein, is not to be construed as a transitory signal per se, such as an electric wave, a freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted through a wire.

[0112] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and transfers the computer-readable program instructions for storage in a computer-readable storage medium within the respective computing / processing device.

[0113] The computer readable program instructions for carrying out the operations of the present invention may be assembler instructions, instruction set architecture (ISA) instructions, machine language instructions, machine dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, including object oriented languages ​​such as Smalltalk, C++ or the like, procedural languages ​​such as the C programming language or similar programming languages. The computer readable program instructions may be executed as a stand-alone software package, entirely on the user's computer, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or wide area network (WAN), or the connection may be made to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, the electrical circuitry may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to individualize the electrical circuitry, which may include, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), to perform aspects of the invention.

[0114] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, may be implemented by computer readable program instructions.

[0115] These computer readable program instructions are provided to a computer processor or other programmable data processing apparatus to generate a machine such that the instructions, executed via the computer processor or other programmable data processing apparatus, create means for implementing the functions / acts identified in a block or blocks of the flowchart diagrams and / or blocks. These computer readable program instructions may also be stored on a computer readable storage medium capable of directing a computer, programmable data processing apparatus or other device or combination thereof to function in a particular manner, such that a computer readable storage medium having instructions stored thereon includes an article of manufacture including instructions that implement aspects of the functions / acts identified in a block or blocks of the flowchart diagrams and / or blocks.

[0116] The computer readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device and cause the computer, other programmable data processing apparatus, or other device to perform a series of operational steps to generate a computer-implemented process such that the instructions executing on the computer, other programmable data processing apparatus, or other device implement aspects of the functions / actions identified in a block or blocks of the flowchart and / or blocks.

[0117] The flowcharts and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a particular logical function(s). In some alternative implementations, the functions noted in the blocks may occur out of the order depicted in the drawings. For example, two blocks shown in succession may in fact be completed as one step simultaneously, substantially simultaneously, or in a partially or fully overlapping manner in time, or the blocks may be executed in reverse order depending on the functionality involved. It should be noted that each block of the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations may be implemented by a special-purpose hardware-based system that performs a particular function or action or implements a combination of special-purpose hardware and computer instructions.

[0118] In addition to the above, one or more aspects may be provided, offered, deployed, managed or serviced by a service provider that provides management of a customer environment. For example, the service provider may create, maintain, support, etc., computer code and / or computer infrastructure that executes one or more aspects for one or more customers. In return, the service provider may receive payments from the customer, for example, under a subscription or fee agreement or both. Additionally or alternatively, the service provider may receive payments from the sale of advertising content to one or more third parties.

[0119] In one aspect, an application may be deployed to execute one or more embodiments. By way of example, deploying an application includes providing a computer infrastructure operable to execute one or more embodiments.

[0120] As a further aspect, a computing infrastructure may be deployed that includes computer readable code integrated into a computing system, where the code in combination with the computer system is capable of executing one or more embodiments.

[0121] As yet another aspect, a process may be provided for integrating a computing infrastructure including integrating computer readable code into a computer system, the computer system including a computer readable medium, the computer readable medium including one or more embodiments, the code in combination with the computer system being capable of executing one or more embodiments.

[0122] Although various embodiments are described above, these are by way of example only, for example, computing environments of other architectures can be used to incorporate and use one or more of the embodiments.

[0123] The terms used herein are for the purpose of describing particular embodiments only and are not intended to be limiting. As used herein, the singular forms "a," "an," and "the" are intended to include the plural unless the context clearly indicates otherwise. Furthermore, it is to be understood that the terms "comprise" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, or components, or combinations thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or groups thereof, or combinations thereof.

[0124] Corresponding structures, materials, acts, and equivalents of all means or step-plus-function elements in the claims are intended to include any structures, materials, or acts for performing functions in combination with other claimed elements, if any, specifically claimed. The description of one or more embodiments has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the disclosed forms. Many modifications and variations will be apparent to those skilled in the art. The present embodiments have been selected and described to best explain various aspects and practical applications, allowing those skilled in the art to understand various embodiments with various modifications to suit the particular use contemplated.

Claims

1. 1. A computer-implemented method comprising: Detecting an attack on a container hosting environment, the attack posing a potential threat of contamination to a hosted container of the container hosting environment, the container hosting environment including an active container pool of active containers for servicing workloads and a spare container pool of spare containers ready for deployment to the active container pool; identifying a time to contamination based on detecting the attack, the time to contamination being considered as the amount of time it takes for an active container in the active container pool to become contaminated as a result of the attack; provisioning new containers into the reserve container pool at a determined rate based on the identified time to contamination; successively removing from the active container pool active containers that are servicing the workload and simultaneously deploying spare containers from the spare container pool into the active container pool to replace the removed active containers and take over servicing the workload; 4. A computer-implemented method comprising:

2. 2. The computer-implemented method of claim 1, wherein the step of successively removing and simultaneously deploying active containers servicing the workload is performed regardless of whether the active containers being removed are detected as being compromised as a result of the attack.

3. 2. The computer-implemented method of claim 1, further comprising determining the rate at which to provision new containers in the spare container pool, the determining being based on the time to contamination, a total number of concurrently active containers servicing the workload, and an amount of time to spin up and provision new containers in the spare container pool.

4. 4. The computer-implemented method of claim 3, wherein the determined rate is determined as Z / Y*X, where Z is the amount of time to spin up and provision a new container in the spare container pool, Y is the time to contamination, and X is the total number of concurrent active containers servicing the workload, and the determined rate is the number of containers to provision within each Z period.

5. The computer-implemented method further comprises:

2. The computer-implemented method of claim 1, further comprising temporarily ceasing the provisioning of new containers to the reserve container pool at the determined rate based on a number of reserve containers in the reserve container pool reaching a threshold, the threshold being based on a number of active containers in the active container pool at a time when the number of reserve containers in the reserve container pool reaches the threshold.

6. The computer-implemented method further comprises:

6. The computer-implemented method of claim 5, further comprising resuming the provisioning of new containers into the reserve container pool at the determined rate based on a number of reserve containers in the reserve container pool being equal to a number of active containers in the active container pool.

7. The identified time to contamination is set to a pre-specified initial value as an estimated time to contamination based on information about the detected attack, and the computer-implemented method further comprises: adjusting the identified time to contamination based on detecting an actual contamination of an active container in the active container pool to an amount of time between (i) a first time that the active container was deployed from the reserve container pool to the active container pool and (ii) a second time that the active container was compromised as a result of the attack. The computer-implemented method of claim 1 , comprising:

8. The computer-implemented method further comprises: During successive removals and simultaneous deployments, monitoring whether active containers in the active container pool become contaminated as a result of the detected attacks. The computer-implemented method of claim 1 , further comprising:

9. The computer-implemented method comprises: increasing a rate at which active containers are removed from the active container pool by successively removing them based on detecting in the monitoring step that an active container in the active container pool becomes contaminated as a result of the detected attack.

9. The computer-implemented method of claim 8, wherein the increasing step comprises increasing the rate to equal the determined rate of provisioning new containers in the reserve container pool.

10. (i) in the monitoring step, detecting that an active container in the active container pool has not been compromised as a result of the detected attack, where detecting that the active container has not been compromised as a result of the detected attack is based on configuring the active container with a fix for the detected attack; and (ii) detecting that the attack has ceased, reducing the rate at which active containers are removed from the active container pool by the successive removals based on at least one selected from the group consisting of: The computer-implemented method of claim 8 , comprising:

11. The computer-implemented method further comprises: Steps for performing a graceful shutdown of the active container being removed.

2. The computer-implemented method of claim 1, wherein the graceful shutdown includes saving a state of the removed active container, and a spare container deployed to replace the removed active container resumes processing of a workload using the saved state of the removed active container.

12. 1. A computer system comprising: Memory, a processor in communication with the memory; the computer system comprising: Detecting an attack on a container hosting environment, the attack posing a potential threat of contamination to a hosted container of the container hosting environment, the container hosting environment including an active container pool of active containers for servicing workloads and a spare container pool of spare containers ready for deployment to the active container pool; identifying a time to contamination based on detecting the attack, the time to contamination being considered as the amount of time it takes for an active container in the active container pool to become contaminated as a result of the attack; provisioning new containers into the reserve container pool at a determined rate based on the identified time to contamination; successively removing from the active container pool active containers that are servicing the workload and simultaneously deploying spare containers from the spare container pool into the active container pool to replace the removed active containers and take over servicing the workload; 23. A computer system configured to perform a method comprising:

13. 13. The computer system of claim 12, wherein the step of successively removing and simultaneously deploying active containers servicing the workload is performed regardless of whether the active containers being removed are detected as being compromised as a result of the attack.

14. 13. The computer system of claim 12, wherein the method includes determining the rate at which to provision new containers in the spare container pool, the determining step being based on the time to contamination, a total number of concurrently active containers servicing the workload, and an amount of time to spin up and provision a new container in the spare container pool, the determined rate being determined as Z / Y*X, where Z is the amount of time to spin up and provision a new container in the spare container pool, Y is the time to contamination, X is the total number of concurrently active containers servicing the workload, and the determined rate is a number of containers to provision within each Z period.

15. The identified time to contamination is set to a pre-specified initial value as an estimated time to contamination based on information about the detected attack, the method comprising: adjusting the identified time to contamination based on detecting an actual contamination of an active container in the active container pool to an amount of time between (i) a first time that the active container was deployed from the reserve container pool to the active container pool and (ii) a second time that the active container was compromised as a result of the attack.

13. The computer system of claim 12, comprising:

16. The method comprises: During the successive removals and simultaneous deployments, monitoring whether active containers in the active container pool become compromised as a result of the detected attacks; (i) in the monitoring step, detecting that an active container in the active container pool has not been compromised as a result of the detected attack, where detecting that the active container has not been compromised as a result of the detected attack is based on configuring the active container with a fix for the detected attack; and (ii) detecting that the attack has ceased, reducing the rate at which active containers are removed from the active container pool by the successive removals based on at least one selected from the group consisting of:

13. The computer system of claim 12, comprising:

17. A computer program comprising: Detecting an attack on a container hosting environment, the attack posing a potential threat of contamination to a hosted container of the container hosting environment, the container hosting environment including an active container pool of active containers for servicing workloads and a spare container pool of spare containers ready for deployment to the active container pool; identifying a time to contamination based on detecting the attack, the time to contamination being considered as the amount of time it takes for an active container in the active container pool to become contaminated as a result of the attack; provisioning new containers into the reserve container pool at a determined rate based on the identified time to contamination; successively removing from the active container pool active containers that are servicing the workload and simultaneously deploying spare containers from the spare container pool into the active container pool to replace the removed active containers and take over servicing the workload; A computer program for executing the above.

18. 20. The computer program product of claim 17, wherein the step of successively removing and simultaneously deploying active containers servicing the workload is performed regardless of whether the active containers being removed are detected as being compromised as a result of the attack.

19. The computer program includes:

20. The computer program product of claim 17, further comprising determining the rate at which to provision new containers in the spare container pool, the determining step being based on the time to contamination, a total number of concurrently active containers servicing the workload, and an amount of time to spin up and provision a new container in the spare container pool, the determined rate being determined as Z / Y*X, where Z is the amount of time to spin up and provision a new container in the spare container pool, Y is the time to contamination, X is the total number of concurrently active containers servicing the workload, and the determined rate is a number of containers to provision within each Z period.

20. The identified time to contamination is set to a pre-specified initial value as an estimated time to contamination based on information about the detected attack, and the computer program causes the computer to: adjusting the identified time to contamination based on detecting an actual contamination of an active container in the active container pool to an amount of time between (i) a first time that the active container was deployed from the reserve container pool to the active container pool and (ii) a second time that the active container was compromised as a result of the attack.

20. The computer program product of claim 17, further comprising:

Images