1. A system, comprising: one or more computer processors; and memory containing a program which when executed by the one or more computer processors, performs an operation comprising: collecting performance metrics of: (i) a first virtual machine, and (ii) a first host machine in a cloud computing environment executing the first virtual machine; determining, based on the collected performance metrics, that use of a first system resource of the first host machine exceeds a first threshold; detecting a resource conflict between the first virtual machine and a third virtual machine executing on the first host machine; programmatically generating, based on the collected performance metrics, the resource conflict, and the use of the first system resource of the first host machine exceeding the first threshold, a first rule to restrict co-location of the first virtual machine with other virtual machines on host machines in the cloud computing environment; associating the first rule with a parent image of the first virtual machine and the third virtual machine, wherein the first virtual machine is a clone of the parent image; enforcing the first rule in the cloud computing environment by: (i) restricting a second virtual machine cloned from the parent image from being co-located with the first virtual machine on the first host machine, (ii) deploying the second virtual machine on a second host machine in the cloud computing environment, and (iii) moving the third virtual machine from the first host machine to a third host machine to resolve the conflict; collecting additional performance metrics of: (i) the first and second virtual machines, and (ii) the first and second host machines; determining, based on the additional performance metrics, that use of a second system resource of the first host machine exceeds a second threshold; and modifying the first rule based on the additional performance metrics of the second system resource, wherein the modified first rule further restricts co-location of virtual machines based on the second system resource.