1. A method for security in a container-based virtualization environment comprising: receiving metadata about a deployed container from a container orchestration layer, the deployed container being deployed in a server; determining an application or service performed by the deployed container from the received metadata by processing data packets to identify the determined application or service; retrieving at least one model using the determined application or service, the at least one model identifying expected network communications behavior of the deployed container; generating a high-level declarative security policy associated with the deployed container using the at least one model, the high-level declarative security policy indicating at least an application or service with which the deployed container is permitted to communicate; producing a low-level firewall rule set using the high-level declarative security policy; and applying the low-level firewall rule set to data network traffic.