A host computing device for managing container access to trusted network resources(122 to 122(n)) in a host operating system of the host computing device, the host computing device comprising: storage hardware and processing hardware; the storage hardware storing the host operating system configured to execute on the processing hardware and manage execution of containers (130 to 130(n)), the containers comprising respective processes managed by the host operating system, each container comprising a separate, isolated execution environment, the containers including client containers, each client container comprising guest software configured to execute therein; and the host operating system including a network filter configured to change data associated with packets of a trusted network resource to ensure that the trusted network resource is accessed only by the host operating system and is prevented from being accessed by any of the one or more of containers (130 to 130(n)), the network filter further configured to: determine whether to pass the packet through to the trusted network resource by determining, from the identifier or address in the packet, whether the address or the identifier was obtained from a domain name service "DNS" query for the trusted network resource; and based on determining that the address or the identifier was obtained from a DNS query for the trusted network resource, passing the packet through a network interface card "NIC" of the computing device to be routed to the trusted network resource. storage hardware and processing hardware; the storage hardware storing the host operating system configured to execute on the processing hardware and manage execution of containers (130 to 130(n)), the containers comprising respective processes managed by the host operating system, each container comprising a separate, isolated execution environment, the containers including client containers, each client container comprising guest software configured to execute therein; and the host operating system including a network filter configured to change data associated with packets of a trusted network resource to ensure that the trusted network resource is accessed only by the host operating system and is prevented from being accessed by any of the one or more of containers (130 to 130(n)), the network filter further configured to: determine whether to pass the packet through to the trusted network resource by determining, from the identifier or address in the packet, whether the address or the identifier was obtained from a domain name service "DNS" query for the trusted network resource; and based on determining that the address or the identifier was obtained from a DNS query for the trusted network resource, passing the packet through a network interface card "NIC" of the computing device to be routed to the trusted network resource. determine whether to pass the packet through to the trusted network resource by determining, from the identifier or address in the packet, whether the address or the identifier was obtained from a domain name service "DNS" query for the trusted network resource; and based on determining that the address or the identifier was obtained from a DNS query for the trusted network resource, passing the packet through a network interface card "NIC" of the computing device to be routed to the trusted network resource.