1. An apparatus comprising: at least one container host device implementing containers for respective tenants of a multi-tenant environment; a storage platform coupled to the container host device and implementing storage resources for utilization by the containers; a container storage controller associated with the container host device; and a storage intrusion detector; wherein the containers are implemented utilizing operating system kernel control groups of the container host device; wherein the container storage controller is configured to provision portions of the storage resources for respective ones of the containers including for each of the containers at least one storage volume; wherein the storage intrusion detector is configured to detect a condition under which a process not associated with a given one of the containers attempts to access the storage volume provisioned for that container; and wherein an alert is generated responsive to the detected condition; the storage intrusion detector comprising: a monitoring component implemented in user space of an operating system of the container host device; and a kernel module implemented in kernel space of the operating system of the container host device; wherein the kernel module is configured to intercept system calls involving reading from or writing to the storage volume of the given container; and wherein the monitoring component is configured to compare an identifier of the given container to process identifiers associated with a plurality of intercepted system calls, and to generate the alert if at least one of the process identifiers is inconsistent with the identifier of the given container.