Security fix of a container in a virtual machine environment

A method, a computer program product, and a computer system for a security fix of a container in a VM (virtual machine) environment. A computer detects a container in a container environment, determines whether the container has a security issue performs live migration of the container to a created VM, fixes the security issue of the container in the created VM, and determines whether the security issue is fixed. In response to determining that the security issue is fixed, the computer performs live migration of the created VM to the container environment.

BACKGROUND

The present invention relates generally to a Linux container infrastructure, and more particularly to a security fix of a container in a VM (virtual machine) environment.

More and more companies providing hosting and cloud services are adopting Linux container solutions. The Linux container solutions are emerging cloud technology based on fast and lightweight process virtualization that provides users with an environment as close as possible to a standard Linux distribution. Due to the fact that containers are lightweight compared to VMs, more instances of containers can be deployed than VMs on a host and in less time.

One of the main constraints is poor isolation between containers. Since containers share the same kernel as the host, all infrastructure will be vulnerable to kernel exploits, and malicious code may put the whole environment in danger. For example, Shocker is a malicious code that lets a Docker container access any file on a host, including sensitive information; this compromises security of the host and any other Docker containers on the host. The problem regarding the isolation between containers is still an open problem to the IT industry.

SUMMARY

In one aspect, a method for a security fix of a container in a VM (virtual machine) environment is provided. The method is implemented by a computer. The method includes detecting a container in a container environment. The method further includes determining whether the container has a security issue. The method further includes performing live migration of the container to a created VM. The method further includes fixing the security issue of the container in the created VM. The method further includes determining whether the security issue is fixed. The method further includes performing live migration of the created VM to the container environment, in response to determining that the security issue is fixed.

In another aspect, a computer program product for a security fix of a container in a VM (virtual machine) environment is provided. The computer program product comprises a computer readable storage medium having program code embodied therewith. The program code executable to: detect a container in a container environment; determine whether the container has a security issue; perform live migration of the container to a created VM; fix the security issue of the container in the created VM; determine whether the security issue is fixed; and perform live migration of the created VM to the container environment, in response to determining that the security issue is fixed.

In yet another aspect, a computer system for a security fix of a container in a VM (virtual machine) environment is provided. The computer system comprises one or more processors, one or more computer readable tangible storage devices, and program instructions stored on at least one of the one or more computer readable tangible storage devices for execution by at least one of the one or more processors. The program instructions are executable to detect a container in a container environment. The program instructions are executable to determine whether the container has a security issue. The program instructions are executable to perform live migration of the container to a created VM. The program instructions are executable to fix the security issue of the container in the created VM. The program instructions are executable to determine whether the security issue is fixed. The program instructions are executable to perform live migration of the created VM to the container environment, in response to determining that the security issue is fixed.

DETAILED DESCRIPTION

Embodiments of the present invention disclose an automated method for identification, isolation, and fixing of problems in a given container infrastructure. By taking advantage of isolation of a VM environment and information about the inventory of all system and data hosted on a Linux container infrastructure, the automated management process guarantees that a container is working properly or is isolated awaiting for manual maintenance.

In embodiments of the present invention, the automated method is used to guarantee that a given container works properly or is isolated from the rest of the infrastructure; therefore, the automated method guarantee that the container does not exploit any security and/or performance flaws due to a kernel issue or the lack of properly configuration of the container. For example, in the Shocker issue mentioned previously in this document, a container running the malicious code can be separated from a container infrastructure, by creating a VM and performing live migration of the container to the VM. The security fix is then applied to the container in the VM environment, and then the container is reinstated in the original host—the container infrastructure.

A container is migrated to a VM when there is one of the following problems, for example: (1) a monitoring tool detects some potential security flaws in a container infrastructure, (2) there is performance hassling (e.g., disk I/O problems) in the container, and (3) an application in the container does not behave well. While in a VM environment, an apparatus runs some more detailed tests, in an automated fashion. It fixes one or more problems if possible and then moves the VM snapshot back to the container. If the one or more problems persist, the VM is hold on quarantine and waits for human intervention.

Embodiments of the present invention increase security by monitoring and isolating problematic containers, minimize wasting of human efforts in events of massive flaws of containers in a Linux based container environment, and expedite the procedures to recover containers that are not working properly. The main goal of the automated method is to minimize human intervention while keeping a high degree of confidence that the Linux based container environment is taken care of.

FIG. 1is a diagram illustrating system100for a security fix of a container in a VM (virtual machine) environment, in accordance with one embodiment of the present invention. System100comprises container1(110), container2(120), and container3(130) in a container environment. It should be appreciated thatFIG. 1provides only an illustration; the container environment comprises multiple containers. A container is an operating-system-level virtualization method for running multiple isolated Linux systems (containers) on a control host using a single Linux kernel. In the embodiment of the present invention shown inFIG. 1, each of the containers comprises an intrusion detection system. Container1(110) comprises intrusion detection system1(115), container2(120) comprises intrusion detection system2(125), and container3(130) comprises intrusion detection system3(135). The intrusion detection system is used as an option to detect malicious activities and security issues in each container. System100further comprises container hypervisor140. Hypervisor140provides a set of Linux container management tools. System100further comprises VM150and VM hypervisor160which creates and runs VM150.

System100further comprises central agent170. Central Agent170takes action based on reports provided by intrusion detection system1(115), intrusion detection system2(125), and intrusion detection system3(135). Central agent170hosts a security database of known security issues including malware, virus, and known bugs. Central agent170continuously monitors a plurality of containers against the security database. Central agent170maintains an affected group which includes affected containers that have security issues and need to be migrated to respective VMs. In the embodiment shown inFIG. 1, container3(130) is such a container in the affected group. For example, container3(130) has problems of security attacks, bad performance behaviors, or not working properly. Central agent170performs live migration of affected containers to new and clean VMs. For example, as shown inFIG. 1, central agent170performs live migration of container3(130) to VM150. Central agent170performs detailed tests on the affected containers and applies remedies to the security issues in the VM environments. For example, as shown inFIG. 1, central agent170fixes security issues of container130in the environment of VM150. When the security issues are remedied, central agent170performs live migration of the VMs to the container infrastructure, restoring the containers in the containers infrastructure. For example, as shown inFIG. 1, central agent170performs live migration of VM150to the container infrastructure, restoring container3(130) in the container infrastructure. If the security issues are persistent, central agent170adds the affected containers to quarantine and identifies the affected containers as ones need human intervention.

The following is the process continuously running by central agent170.for each container c in environment:

detect_problem(c)if problem found thenadd container c to affected_groupdonefor each container c in affected_grouplive_migrate_to_new_vm(c)add vm created to vm_listdonefor each VM vm in vm_listtry_fix(vm)if fix failed thenadd vm to quarantine and wait for human interventionelsemigrate vm snapshot back to original containerdone

FIG. 2is flowchart200showing operational steps for a security fix of a container in a VM (virtual machine) environment, in accordance with one embodiment of the present invention. For example, the operational steps are implemented by central agent170shown inFIG. 1. At step210, central agent170detects each of containers in a container environment. At step220, central agent170determines whether there is any security issue with a respective one of the containers. In response to determine that there is any security issue with the respective one of the containers (YES branch of step220), central agent170adds the respective one of the container to an affected group. In response to determine that there is no security issue with the respective one of the containers (NO branch of step220), central agent170reiterates steps210and220until all the containers in the container environment are detected. After finishing detection of all the containers in the container environment, at step230, central agent170add affected containers to the affected group. Steps210-230are described in the first block of the pseudo code presented in the previous paragraph.

At step240, central agent170performs live migration of the affected containers in the affected group to respective created VMs and destroys the affected containers. At step250, central agent170adds the respective created VMs to a list of VMs. Steps240and250are described in the second block of the pseudo code presented in the previous paragraph.

At step260, central agent170fixes security issues in the respective created VMs. At step270, central agent170determines whether a respective one of the created VMs is fixed. In response to determines that the respective one of the created VMs is fixed (YES branch of step270), at step280, central agent170performs live migration of a snapshot of the respective one of the created VMs to the container environment and destroys the respective one of the created VMs. In response to determines that the respective one of the created VMs is not fixed (NO branch of step270) or the security issues are persistent, at step280, central agent170adds the respective one of the created VMs to quarantine waiting for human intervention. Steps260-280are described in the third block of the pseudo code presented in the previous paragraph.

FIG. 3is a diagram illustrating components of computer device300hosting system100shown inFIG. 1, in accordance with one embodiment of the present invention. It should be appreciated thatFIG. 3provides only an illustration of one implementation and does not imply any limitations with regard to the environment in which different embodiments may be implemented. Computer device300may be capable of receiving input from a user, executing computer program instructions, and communicating with another computing system via a network.

Referring toFIG. 3, computer device300includes processor(s)320, memory310, and tangible storage device(s)330. InFIG. 3, communications among the above-mentioned components of computer device300are denoted by numeral390. Memory310includes ROM(s) (Read Only Memory)311, RAM(s) (Random Access Memory)313, and cache(s)315. One or more operating systems331and one or more computer programs333reside on one or more computer readable tangible storage device(s)330. System100resides on one or more computer readable tangible storage device(s)330. Computer device300further includes I/O interface(s)350. I/O interface(s)350allows for input and output of data with external device(s)360that may be connected to computer device300. Computer device300further includes network interface(s)340for communications between computer device300and a computer network.