Securing CI/CD Runners Through eBPF Agent
summary
An open source tool called control uses an eBPF agent plus an OPA/Rego policy engine to monitor and allow-list outbound IPs and DNS responses from CI/CD runners, shipping as a single Go binary or Docker image for GitHub/GitLab self‑hosted runners. Demo shows it detects and blocks secret‑exfiltration and malicious package C2 attempts by process, but it requires root privileges and currently cannot always terminate already established sockets; roadmap adds file/process sensors and dynamic Rego updates.
AI-written summary · about
chapters (10)
- 0:00Securing CI/CD runners
- 1:03Introducing Control eBPF agent
- 2:51Supply chain attack risks
- 5:43Network connections in attacks
- 9:15eBPF-based security design
- 12:08eBPF development challenges
- 16:24Monitoring CI/CD traffic
- 19:21Live demo of Control
- 22:45Adoption and roadmap
- 27:22Open source call
related talks
20mSecuring CI/CD Runners Through eBPF
36mSecuring CI/CD Systems Through eBPF
25mOpen Policy Agent as a Control Engine
36meBPF for Runtime Security
29mRuntime Security at Scale With EBPF: Hybrid Detection and Root Cause…
33mDetecting Compromised CI With eBPF and Cilium Tetragon
36mOpen Policy Agent: security for cloud natives and everyone else
25mProtecting Modern Workloads with eBPF superpowers