# kubearmor/KubeArmor

Runtime Security Enforcement System. Workload hardening/sandboxing and implementing least-permissive policies made easy leveraging LSMs (LSM-BPF, AppArmor).

Repository: https://github.com/kubearmor/KubeArmor
Canonical: https://ross.abutalabs.com/products/kubearmor
Homepage: https://kubearmor.io/
Language: Go
License: Apache-2.0
License Family: permissive
Topics: lsm, tool, security, containers, kubernetes, policy, system, bpf, ebpf, kernel, hacktoberfest, sandbox
Last push: 2026-08-26T09:37:47+00:00

## Health v2 (maintenance only)
Score: 97/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 93, longevity 100
- inputs: {"age_days": 2107, "days_push": 7, "days_rel": 51, "gap_med": 10, "n_releases_24m": 40}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2588, forks 522 (observed 2026-08-28T04:07:02.815351+00:00)

## What it is
KubeArmor is a cloud-native runtime security enforcement system that restricts process execution, file access, and networking behavior of pods, containers, and nodes at the system level. It leverages Linux Security Modules (AppArmor, SELinux, BPF-LSM) to enforce user-specified policies and uses eBPF to generate rich alerts and telemetry events with container, pod, and namespace identities.

## Use cases
- enforce least-permissive process and network whitelisting for kubernetes pods
- harden container workloads against MITRE, STIG, and CIS based attack techniques
- sandbox pods and containers without modifying pod specs or host configuration
- monitor and audit process executions, file accesses, and network connections in containers
- protect sensitive assets like cert bundles and raw database tables from unauthorized access
- profile system calls and application behavior for security visibility
- enforce runtime security policies on VMs and bare-metal hosts via systemd mode

## When to choose
- you need inline, proactive runtime enforcement rather than post-attack detection
- you run Kubernetes across clouds with inconsistent default LSMs and want a unified policy layer
- you want to apply least-permissive access controls to containers without changing application code

## When to avoid
- you only need static image scanning or CI/CD vulnerability checks rather than runtime enforcement
- your hosts or kernels lack support for AppArmor, SELinux, or BPF-LSM
- you need runtime security for non-Linux platforms such as Windows or macOS

## Facets
- artifact type: service
- maturity: active
- function: security, monitoring, alerting, container-runtime, middleware
- domain: security, cloud-computing, monitoring, self-hosted
- platform: go, self-hosted
- tags: runtime-security, lsm, apparmor, ebpf, bpf-lsm, selinux, workload-hardening, sandboxing, least-permissive, cncf, daemonset, policy-enforcement, containers, devops, linux, kubernetes, docker

## Member repositories
- kubearmor/KubeArmor (main) score 97

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:02.815351+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:22:24.015926+00:00, confidence not recorded.
  - readme: https://github.com/kubearmor/KubeArmor (fetched 2026-08-28T04:07:02.815351+00:00, sha af1214cd44d0)
  - homepage: https://kubearmor.io/ (fetched 2026-08-29T10:04:44.510096+00:00, sha c8ccab7f7623)
  - site_page: https://docs.kubearmor.io/kubearmor (fetched 2026-08-29T10:04:44.512958+00:00, sha b3ddb59141e9)
  - site_page: https://docs.kubearmor.io/kubearmor/quick-links/deployment_guide (fetched 2026-08-29T10:04:44.514862+00:00, sha aafd8b307557)
- Data as of 2026-08-30T08:39:29.467469+00:00.