Fig. 6From: Optimus: association-based dynamic system call filtering for container attack surface reductionWorkflow of container creation and initialization. Red words highlight the changes in the cgroup, the PID namespace, and the PIDBack to article page