Container-Level Auditing in Container Orchestrators with eBPF

Autor(es)

Bertinatto, Fabio Junior ; Arioza, Daniel ; Nobre, Jeferson Campos ; Granville, Lisandro Zambenedetti

• Tipo de documento: Artigo Científico
• Fonte: ADVANCED INFORMATION NETWORKING AND APPLICATIONS, VOL 4, AINA 2024; v. 202, p. 12-pg., 2024-01-01.

Resumo

This paper examines the application of eBPF (extended Berkeley Packet Filter) for achieving more precise auditing at the container level in container orchestrators such as Kubernetes. We address the challenges associated with auditing container behavior and highlight the advantages of leveraging eBPF to monitor container activities at the kernel level. We propose an eBPF-based solution that enhances transparency with respect to operations performed within containers. Overall, this study suggests that the use of eBPF for container-level auditing can provide valuable insights into container behavior and improve the security of containerized applications. (AU)

• Processo FAPESP: 20/05152-7 - PROFISSA: internet do futuro programável para arquiteturas e softwares seguros
• Beneficiário: Lisandro Zambenedetti Granville
• Modalidade de apoio: Auxílio à Pesquisa - Temático