Method for protecting a process of setting up a subdirectory and/or a network interface for a container instance for providing a container-based application, wherein at least one subdirectory of the container instance is provided by allocating at least one subdirectory in a source directory of an assigned physical data memory and at least one network interface of the container instance is provided by allocating at least one corresponding virtual or physical network interface of an assigned host computer, comprising - generating a directory policy comprising at least one incorporation rule for allocating the subdirectory of the container instance to the subdirectory in the source directory; and/or - generating an interface policy comprising at least one incorporation rule for allocating the network interface of the container instance to the network interface of the assigned host computer, - loading a container image, an assigned configuration file, and the directory policy and/or the interface policy into a runtime environment of the host computer, - in the runtime environment before the process of starting the container instance, checking whether all subdirectories in the source directory that are stipulated by the container image for the container instance are able to be incorporated according to the directory policy, and/or whether all network interfaces that are stipulated by the configuration file are able to be incorporated according to the interface policy without contravening incorporation options for subdirectories and network interfaces of further container instances that already exist, and - generating the container instance from the container image in the host computer only in the event of a positive checking result, wherein a subdirectory is not incorporated into the container instance if upon the checking of container instances which have been formed from other container images and/or with other configuration files, vis-à-vis the directory policy, it is established that the directory policy contains no permitted incorporation option for the subdirectory to be incorporated or the subdirectory to be incorporated is a superordinate or subordinate directory with respect to a subdirectory not mentioned in the directory policy, and/or wherein a network interface is not incorporated if upon the checking of container instances which have been formed from other container images and/or with other configuration files, vis-à-vis the interface policy, it is established that the interface policy contains no permitted incorporation option for the network interface to be incorporated. - generating a directory policy comprising at least one incorporation rule for allocating the subdirectory of the container instance to the subdirectory in the source directory; and/or - generating an interface policy comprising at least one incorporation rule for allocating the network interface of the container instance to the network interface of the assigned host computer, - loading a container image, an assigned configuration file, and the directory policy and/or the interface policy into a runtime environment of the host computer, - in the runtime environment before the process of starting the container instance, checking whether all subdirectories in the source directory that are stipulated by the container image for the container instance are able to be incorporated according to the directory policy, and/or whether all network interfaces that are stipulated by the configuration file are able to be incorporated according to the interface policy without contravening incorporation options for subdirectories and network interfaces of further container instances that already exist, and - generating the container instance from the container image in the host computer only in the event of a positive checking result, wherein a subdirectory is not incorporated into the container instance if upon the checking of container instances which have been formed from other container images and/or with other configuration files, vis-à-vis the directory policy, it is established that the directory policy contains no permitted incorporation option for the subdirectory to be incorporated or the subdirectory to be incorporated is a superordinate or subordinate directory with respect to a subdirectory not mentioned in the directory policy, and/or wherein a network interface is not incorporated if upon the checking of container instances which have been formed from other container images and/or with other configuration files, vis-à-vis the interface policy, it is established that the interface policy contains no permitted incorporation option for the network interface to be incorporated. wherein a subdirectory is not incorporated into the container instance if upon the checking of container instances which have been formed from other container images and/or with other configuration files, vis-à-vis the directory policy, it is established that the directory policy contains no permitted incorporation option for the subdirectory to be incorporated or the subdirectory to be incorporated is a superordinate or subordinate directory with respect to a subdirectory not mentioned in the directory policy, and/or wherein a network interface is not incorporated if upon the checking of container instances which have been formed from other container images and/or with other configuration files, vis-à-vis the interface policy, it is established that the interface policy contains no permitted incorporation option for the network interface to be incorporated.