Malicious code avoidance using transparent containers

Abstract

A method, computer program product, and system for managing container security, the method including consuming a recipe queue on a first checker container, wherein the first checker container is on a first host of a computer system, and the recipe queue comprises a predefined set of rules, storing the first checker container recipe queue result in the first checker container, comparing the first checker container recipe queue result with an expected result of the recipe queue, wherein the expected result is stored in the first checker container, and following a first fail procedure from a plurality of fail procedures, based on the first checker container recipe queue result not matching the expected result.

What is claimed is: 
     
         1 . A method for managing container security by a computer, the method comprising:
 storing a recipe queue on a set of checker containers, wherein each checker container of the set of checker containers is on a corresponding host of a set of hosts of a computer system, wherein each checker container of the set of checker containers is not accessible to a corresponding host of the set of hosts, wherein the recipe queue comprises a predefined set of rules;   consuming the recipe queue on a first checker container of the set of checker containers, wherein the first checker container is on the first host of the set of hosts;   storing a first result from the consumed recipe queue in the first checker container in the first checker container;   comparing the first result with an expected result of the recipe queue, wherein the expected result is stored in the first checker container;   based on the first result not matching the expected result, consuming the recipe queue on a second checker container of the set of checker containers, wherein the second checker container is on a second host of set of hosts;   storing a second result from the consumed recipe queue in the second checker container in the second checker container;   comparing the second result with the expected result of the recipe queue, wherein the expected result is stored in the second checker container;   based on the first result not matching the expected result and the second result matching the expected result, rebooting the first host;   based on the second result not matching the expected result, consuming the recipe queue on one or more additional checker containers of the set of checker containers, wherein the one or more additional checker containers are on one or more corresponding additional hosts of the set of hosts;   storing one or more additional results from the consumed recipe queue in the one or more additional checker containers each on the corresponding one or more additional checker containers;   comparing the one or more additional results with the expected result of the recipe queue, wherein the expected result is stored on the one or more additional checker containers;   based on the first result and the second result not matching the expected result and the one or more additional results matching the expected result, rebooting the first host and rebooting the second host;   based on the one or more additional results not matching the expected result, reconfirming the expected result; and   shutting the computer system down, based on more than a threshold number of the recipe queue results not matching the expected result, wherein the recipe queue results comprise the first result, the second result, and the one or more additional results.