Runtime & eBPF security

Correct — Attach logic at kernel hooks with no reboot and no out-of-tree module.

Correct — It rejects programs that could crash or hang the kernel.

Correct — How a probe passes events and config to the userspace agent.

Correct — These observe syscalls, kernel functions, security decisions, and packets.

Correct — A process cannot hide a syscall it must make from a kernel-level probe.

Correct — Policy logic runs at the same hooks SELinux/AppArmor use.

Correct — The eBPF probe avoids shipping an out-of-tree kernel module.

Correct — Portability (CO-RE) and safety reduce operational risk.

Correct — One binary adapts to differing kernel struct layouts.

Correct — The constraints are what let untrusted logic run safely in the kernel.

Correct — eBPF sees flows and calls transparently.

Correct — A chokepoint that malware cannot avoid to interact with the system.

Correct — Not a VM — kernel isolation is the security boundary to harden.

Correct — Each namespace type isolates one kind of global resource.

Correct — Container "root" is not host root, shrinking escape impact.

Correct — Drop ALL and add just CAP_NET_BIND_SERVICE, for example.

Correct — Often called “the new root”; avoid it.

Correct — A seccomp-BPF profile shrinks the kernel attack surface.

Correct — A sane baseline that many workloads run under unmodified.

Correct — AppArmor is path-based; SELinux is label/type-based.

Correct — Label-based policy (svirt/MCS) isolates containers on RHEL.

Correct — Minimize identity, writability, privilege, and syscall surface together.

Correct — Combine with tmpfs for the few writable paths needed.

Correct — No single control is perfect; overlapping controls contain a bypass.

Correct — It alerts on things like a shell spawned in a container.

Correct — e.g. spawned_process and container and proc.name=bash → Warning.

Correct — DRY rule-writing: define once, reference in many rules.

Correct — Strong signal of hands-on-keyboard intrusion in prod.

Correct — Untuned rules fire on normal ops; tuning is essential.

Correct — Tune precisely rather than turning rules off wholesale.

Correct — It routes events into your response pipeline.

Correct — Turning detection into containment programmatically.

Correct — Runtime and scanning are complementary, not redundant.

Correct — Node-level coverage catches activity in any pod scheduled there.

Correct — Precision keeps responders trusting the queue.

Correct — One detection engine across kernel and cloud/audit events.

Correct — Detection plus enforcement, not detection-only.

Correct — Declarative, Kubernetes-native runtime policy.

Correct — A userspace agent may react after the damage is done.

Correct — L3–L7 policy, Hubble visibility, kube-proxy replacement.

Correct — Policy follows the workload as pods churn and reschedule.

Correct — Application-aware policy, not just port-level.

Correct — Service maps and flow logs without app instrumentation.

Correct — East-west confidentiality transparently.

Correct — Zero-trust east-west: open only the flows you declare.

Correct — Kill a malicious process and constrain what it can reach.

Correct — Start in observe/alert, validate, then enforce in waves.

Correct — Avoid an outage from a policy that is too aggressive on day one.

Correct — privileged: true is close to running on the host.

Correct — Control of the daemon is control of the host.

Correct — Host filesystem access is a direct path off the container.

Correct — It re-enables much of what container isolation removed.

Correct — Patch runtimes promptly; the boundary is software with bugs.

Correct — One kernel bug can undermine every container on the host.

Correct — The escape technique produces kernel activity a probe can catch.

Correct — They shrink the shared-kernel attack surface for untrusted workloads.

Correct — Contain the blast radius and preserve evidence before cleanup.

Correct — Capture first, then remediate — mirrors cloud IR.

Correct — Attackers persist in the cluster and on the node, not just the pod.

Correct — Remove the enablers, patch the bugs, and watch for the rest.