KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operations) of pods, containers, and nodes (VMs) at the system level.

KubeArmor leverages Linux security modules (LSMs) such as AppArmor, SELinux, or BPF-LSM to enforce the user-specified policies. KubeArmor generates rich alerts/telemetry events with container/pod/namespace identities by leveraging eBPF.

Architecture Overview

Documentation 📓

• 👉 Getting Started
• 🎯 Use Cases
• ✔️ KubeArmor Support Matrix
• ♟️ How is KubeArmor different?
• 📜 Security Policy for Pods/Containers [Spec] [Examples]
• 📜 Cluster level security Policy for Pods/Containers [Spec] [Examples]
• 📜 Security Policy for Hosts/Nodes [Spec] [Examples]
• 📜 Network Security Policy for Hosts/Nodes [Spec] [Examples]
  ... detailed documentation

Contributors 👥

• 📘 Contribution Guide
• 🧑‍💻 Development Guide, Testing Guide
• ✋ Join KubeArmor Slack
• ❓ FAQs

Biweekly Meeting

• 🗣️ Zoom Link
• 📄 Minutes: Document
• 📆 Calendar invite: Google Calendar, ICS file

KubeArmor is a community-governed project. The following documents describe how the project is run:

• 📜 Governance — roles, decision-making, vendor neutrality, sub-teams, voting.
• 👥 Maintainers — current Maintainers, Reviewers, and Emeritus Maintainers, with affiliations.
• 🤝 Code of Conduct — we follow the CNCF Code of Conduct.
• 📦 Release Process — cadence, release candidates, release manager, support window.
• 🔒 Security Policy — how to report a vulnerability.

Notice/Credits 🤝

• KubeArmor uses Tracee's system call utility functions.

CNCF

KubeArmor is Sandbox Project of the Cloud Native Computing Foundation.

ROADMAP

KubeArmor roadmap is tracked via KubeArmor Projects

KubeArmor is more than a single repository. The following repositories under the kubearmor GitHub organization are part of the wider project. Each is governed under GOVERNANCE.md — see the Subprojects section there for how core and community subprojects are classified.

Note: This list covers actively maintained repositories. For the complete (including archived) list, see the organization page.

Core

Integrations and adapters

Deployment and packaging

Specialised projects

This list is generated iteratively — open a pull request to add a new repository or correct a description.