Protecting Modern Workloads with eBPF superpowers
summary
Uses eBPF probes for kernel‑level observability and correlates events with Docker/containerd and Kubernetes APIs to add image, pod and process context; pairs inline enforcement via BPF LSM hooks to deny actions like unauthorized file reads or service account token access; ships as KubeArmor daemonset that runs privileged on hosts (or on EKS/GCP/OpenShift), offers audit or deny policies, a discovery engine to generate allowlists, and measures overhead around 5–6 microseconds per hook.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:50Container Runtime Security
- 4:15Monitoring Alerting
- 7:05inline enforcement
- 9:40container runtime enforcement
- 15:50Conclusion
- 16:15QA
- 19:00QA Containers
related talks
47mUsing eBPF to Bring Kubernetes-Aware Security to the Linux Kernel
36meBPF for Runtime Security
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
29mBuzzing Across the Cloud Native Landscape with eBPF
22mRole of eBPF in Kubernetes Networking and Security
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
21mArmoring Cloud Native Workloads With LSM Superpowers