KubeArmor

KubeArmor - enforce runtime security for cont… | Awesome Repos

Features

Runtime Security Enforcement - Restricts process execution, file access, and network operations for containers and nodes by applying system-level security rules that block unauthorized activity in real time.
eBPF Interceptors - Uses kernel-level hooks to monitor and intercept system calls in real time without modifying application source code.
In-Kernel Enforcement Engines - Monitors and blocks unauthorized system calls and operations to harden workloads against potential threats.
Security Policy Enforcers - Leverages Linux Security Modules to apply granular access control rules directly at the operating system kernel boundary.
Declarative Policy Enforcers - Translates high-level security intent into declarative runtime rules for filesystem, network, and system call restrictions.
DevSecOps and Automation - Integrates automated security validation into deployment pipelines to ensure workload configurations meet safety standards.
Cloud-Native Operating Systems - Applies least-permissive security configurations to container workloads to minimize the attack surface.
Security Agent Orchestration - Provides mechanisms to install and orchestrate security agents across containerized environments and physical servers.
Security Testing Pipelines - Integrates automated security checks into deployment pipelines to validate workload configurations against safety policies.
eBPF Security Tools - Uses eBPF and LSMs to restrict process, file, and network activity within containerized environments.
Cross-Platform Security Configurations - Enforces consistent security policies across diverse infrastructure including virtual machines, physical servers, and container clusters.
Namespace-Based Isolation - Maps system-level enforcement actions to specific container and pod identities to maintain isolation within multi-tenant environments.
Security Orchestration - Extends runtime policy enforcement to virtual machines and physical servers through a unified control plane.
Cloud-Optimized Linux Hardening - Implements least-permissive policies across clusters to ensure consistent access control and visibility for all active services.
Security Enforcement Agents - Deploys lightweight enforcement daemons across every node to ensure security policies are applied locally and consistently.
Infrastructure Observability - Monitors and streams system-level events from containers and hosts to external tools for centralized threat detection.
System Activity Monitoring - Tracks process executions, file system accesses, and network connections to provide visibility into application activity.
Defending - Listed in the “Defending” section of the Awesome K8s Security awesome list.

Open-source alternatives to KubeArmor

Similar open-source projects, ranked by how many features they share with KubeArmor.

cilium/tetragon
cilium/tetragon
4,753View on GitHub
Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments. It functions as a security policy manager, observability agent, and enforcement engine that hooks into kernel functions and tracepoints to detect privilege escalation, container escapes, and unauthorized system activity. The project distinguishes itself through its ability to perform real-time, in-kernel enforcement, allowing it to synchronously terminate malicious processes or modify function return values before a system call completes. It provides deep Kubernetes integration
C
View on GitHub4,753
nvidia/openshell
NVIDIA/OpenShell
7,276View on GitHub
OpenShell is a security framework and sandboxed execution runtime for autonomous AI agents. It provides isolated environments using containers and virtual machines to protect host infrastructure and sensitive data from unauthorized access during agent execution. The system distinguishes itself by combining hardware-accelerated passthrough for host GPU access with a security gateway that intercepts model API calls. This gateway manages credentials by stripping caller information and injecting backend secrets, ensuring sensitive API keys remain off the local filesystem. The platform covers bro
Rust
View on GitHub7,276
eunomia-bpf/bpf-developer-tutorial
eunomia-bpf/bpf-developer-tutorial
4,145View on GitHub
This project is an educational resource providing a comprehensive development tutorial for writing and loading eBPF programs using C, Go, and Rust within the Linux kernel. It serves as a technical guide for developing custom logic to execute directly in the kernel. The materials cover specialized domains including kernel observability and tracing, security implementation for intrusion detection, and high-performance network engineering for packet filtering and load balancing. It also includes dedicated manuals for Linux kernel tracing and the use of kprobes, uprobes, and tracepoints. The pro
Cbpfebpfexamples
View on GitHub4,145
armosec/kubescape
armosec/kubescape
11,482View on GitHub
Kubescape is a security platform for Kubernetes that provides tools for scanning clusters, configurations, and container images against industry compliance and security benchmarks. It functions as a suite of security utilities, including a compliance auditor, a misconfiguration scanner, and a container vulnerability scanner. The project differentiates itself through automated remediation and active enforcement. It can automatically patch operating system vulnerabilities in images and fix security errors within manifest files. It also utilizes an admission controller to block the deployment of
Go
View on GitHub11,482

See all 30 alternatives to KubeArmor

kubearmorKubeArmor

Features

Open-source alternatives to KubeArmor

cilium/tetragon

NVIDIA/OpenShell

eunomia-bpf/bpf-developer-tutorial

armosec/kubescape

Star history

Open-source alternatives to KubeArmor

cilium/tetragon

NVIDIA/OpenShell

eunomia-bpf/bpf-developer-tutorial

armosec/kubescape