kubearmor/KubeArmor

Health v2 · maintenance only

Adoption not part of the score

2588 stars · 522 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

KubeArmor is a cloud-native runtime security enforcement system that restricts process execution, file access, and networking behavior of pods, containers, and nodes at the system level. It leverages Linux Security Modules (AppArmor, SELinux, BPF-LSM) to enforce user-specified policies and uses eBPF to generate rich alerts and telemetry events with container, pod, and namespace identities.

Use cases

• enforce least-permissive process and network whitelisting for kubernetes pods
• harden container workloads against MITRE, STIG, and CIS based attack techniques
• sandbox pods and containers without modifying pod specs or host configuration
• monitor and audit process executions, file accesses, and network connections in containers
• protect sensitive assets like cert bundles and raw database tables from unauthorized access
• profile system calls and application behavior for security visibility
• enforce runtime security policies on VMs and bare-metal hosts via systemd mode

When to choose

• you need inline, proactive runtime enforcement rather than post-attack detection
• you run Kubernetes across clouds with inconsistent default LSMs and want a unified policy layer
• you want to apply least-permissive access controls to containers without changing application code

When to avoid

• you only need static image scanning or CI/CD vulnerability checks rather than runtime enforcement
• your hosts or kernels lack support for AppArmor, SELinux, or BPF-LSM
• you need runtime security for non-Linux platforms such as Windows or macOS

Facets

service · maturity active

security monitoring alerting container-runtime middleware security cloud-computing monitoring self-hosted go self-hosted runtime-security lsm apparmor ebpf bpf-lsm selinux workload-hardening sandboxing least-permissive cncf daemonset policy-enforcement containers devops linux kubernetes docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="kubearmor/KubeArmor")