Securing CI/CD Runners Through eBPF
summary
An open source runtime agent called control.dev uses an eBPF agent and Golang to monitor CI/CD runners for malicious install-time behavior, tracking TCP/UDP and DNS events and sending context to an OPA rules engine in userspace. The tool blocks outbound connections in real time, prevented a curl-based secret exfiltration in the demo, and flags base64 leaks from actions. It runs as a privileged binary or Docker container, adds only a few seconds to pipelines, and exports events for graph visualization and forking.
AI-written summary · about
chapters (8)
- 0:00Securing CI/CD runners
- 1:05Supply chain threats rising
- 2:51Build stage vulnerabilities
- 4:17Control tool with eBPF
- 6:01Design and eBPF challenges
- 11:28Detecting data exfiltration
- 15:24Live demo of control
- 19:31Q&A
related talks
30mSecuring CI/CD Runners Through eBPF Agent
36mSecuring CI/CD Systems Through eBPF
36meBPF for Runtime Security
25mProtecting Modern Workloads with eBPF superpowers
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
29mRuntime Security at Scale With EBPF: Hybrid Detection and Root Cause…
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
47mUsing eBPF to Bring Kubernetes-Aware Security to the Linux Kernel