Killing a Container
For the policies that support kill-container responses specify responseAction:
A kill-container response action is performed by sending the
SIGKILL signal to the init process of the container. This causes the entire container to exit immediately. If an alert is fired on a process not in a container and the kill-container response action is specified, no action is taken.
Like kill responses, kill container responses can fail (e.g. if the container has already exited).