Patent ID: 7885975

Claim:
A machine implemented method, comprising: creating a first container within a global operating system environment, wherein the first container is assigned a first sensitivity label, wherein the first container comprises a first isolated execution environment in the global operating system environment, wherein the first isolated execution environment comprises a first file system and a first logical network interface, wherein the first sensitivity label comprises a first sensitivity level of a predefined hierarchical plurality of sensitivity levels and a first category, and wherein the first container serves to prevent processes executing within the first isolated execution environment from accessing files that are not part of the first file system; determining that the global operating system environment comprises a second container, wherein the second container is assigned a second sensitivity label, wherein the second container comprises a second isolated execution environment in the global operating system environment, wherein the second isolated execution environment comprises a second file system and a second logical network interface, wherein the second sensitivity label comprises a second sensitivity level of the predefined hierarchical plurality of sensitivity levels and a second category, and wherein the second container serves to prevent processes executing within the second isolated execution environment from accessing files that are not part of the second file system; determining that the second sensitivity level is higher in the hierarchical plurality of sensitivity levels than the first sensitivity level and that the first category matches the second category, thereby indicating that processes executing within the first container should be allowed to access at least a particular portion of the second file system associated with the second container; and in response to a determination that the second sensitivity level is higher in the hierarchical plurality of sensitivity levels than the first sensitivity level and that the first category matches the second category, incorporating the at least a particular portion of the second file system into the first file system to enable one or more processes executing within the first container to access the particular portion of the second file system.