Securing containers at runtime