I should check with Illumio
At the moment, I don't think it works with containers, but am not sure. Illumio watches the interior workings of a communications table of each workload's operating system, after drawing a graph of the application's allowed activity. Many containers share the same operating system kernel, which it seems to me would be a whole different level of complexity for the Illumio platform. Nothing was said about working with containers but we ran out of time during the interview.