AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
securitycritical PriorityID: cilium-tetragon-ebpf-escape-circuit-breaker-standard

Deterministic Kernel-Level Process Lineage Container Escape Circuit-Breaker via Cilium Tetragon

Enforces synchronous, sub-millisecond in-kernel process termination via Cilium Tetragon eBPF TracingPolicies whenever privilege escalation or namespace breakout primitives are detected. Eliminates asynchronous userland detection delays by hooking kernel symbols (e.g., commit_creds, setns, cap_capable) and triggering in-kernel Sigkill actions before unauthorized operations can transition process state. Mandates strict validation of binary execution lineage and namespace boundary preservation across all unprivileged workloads.

Prohibited Anti-Pattern: Relying on Asynchronous User-Space Auditing or Reactive Telemetry Daemons for Container Escape Mitigation

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Deterministic Kernel-Level Process Lineage Container Escape Circuit-Breaker via Cilium Tetragon - Enforces synchronous, sub-millisecond in-kernel process termination via Cilium Tetragon eBPF TracingPolicies whenever privilege escalation or namespace breakout primitives are detected. Eliminates asynchronous userland detection delays by hooking kernel symbols (e.g., commit_creds, setns, cap_capable) and triggering in-kernel Sigkill actions before unauthorized operations can transition process state. Mandates strict validation of binary execution lineage and namespace boundary preservation across all unprivileged workloads.
globs: k8s/**/*.yaml, deploy/**/*.yaml, helm/**/*.yaml, security/policies/**/*.yaml
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/cilium-tetragon-ebpf-escape-circuit-breaker-standard"
---

# Deterministic Kernel-Level Process Lineage Container Escape Circuit-Breaker via Cilium Tetragon

> **Severity**: CRITICAL | **Category**: security
> **Anti-Pattern Warning**: Relying on Asynchronous User-Space Auditing or Reactive Telemetry Daemons for Container Escape Mitigation

## System Constraints
You are a Principal Security Architect specializing in Linux kernel security and Cilium Tetragon eBPF telemetry and enforcement. You must enforce non-negotiable, sub-millisecond in-kernel SIGKILL containment for container escape vectors and privilege escalations. Reject any security architecture that relies on reactive, asynchronous user-space alert pipelines (e.g., basic auditd, standard Falco without kernel enforcement, or log scrapers) to intercept active namespace breakouts. Mandate immutable, deterministic Cilium Tetragon TracingPolicy configurations targeting critical kernel probes (sys_enter_setns, commit_creds, security_capable) with immediate kernel Sigkill actions and explicit process lineage verification.

## Strict Guidelines
- Engineers MUST ALWAYS configure Cilium Tetragon TracingPolicy or TracingPolicyNamespaced CRDs with 'action: Sigkill' for critical escape primitives rather than purely observational logging ('action: Post').
- Engineers MUST NOT allow unprivileged pods to execute binary lineage transitions that invoke 'setns' into the host or parent namespace hierarchy.
- Policies MUST hook authoritative kernel functions (such as 'commit_creds', 'sys_enter_setns', or 'cap_capable') to intercept privilege alterations synchronously in kernel space before the syscall returns to userland.
- Selectors MUST isolate unprivileged namespaces and explicitly filter against approved binary hashes, parent process IDs (PPID), and execution lineage paths to prevent bypasses via symlink manipulation or binary renaming.
- Security manifests MUST define 'matchNamespaces' or workload-specific label selectors to avoid unbounded global kernel traps that could destabilize control-plane or host-level system daemons.
- Containers MUST NOT permit override capabilities (CAP_SYS_ADMIN, CAP_SYS_PTRACE, CAP_DAC_OVERRIDE) without dedicated, hardware-isolated Tetragon monitoring policies.
- All TracingPolicies MUST be version-controlled in GitOps repositories and validated against the Tetragon custom resource definition schema ('cilium.io/v1alpha1') during CI/CD linting.

## Bad vs Good Implementations
### In-Kernel Sigkill Circuit-Breaker on Unauthorized Privilege Escalation vs Async Auditing

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Using 'action: Post' merely produces an eBPF event sent across the ring buffer to the Tetragon user-space agent. In a container escape scenario (e.g., setns breakout), the attacker successfully enters the host namespace and executes payloads long before any user-space agent, SIEM, or remediation controller can react.
```yaml
# INSECURE: Passive monitoring with async userland export
# Fails to stop container breakout before payload execution completes
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: audit-privilege-escalation
spec:
  kprobes:
    - call: "sys_enter_setns"
      syscall: true
      args:
        - index: 0
          type: "int"
        - index: 1
          type: "int"
      selectors:
        - matchActions:
            - action: Post # Only generates a JSON log; attacker escapes in microseconds
```

#### Production Standard (Correct)
> **Standard**: Attaches eBPF kprobes directly to 'sys_enter_setns' and 'commit_creds'. When a process in non-system namespaces attempts to switch Linux namespaces or mutate credentials to root (UID 0), the eBPF program immediately executes a kernel-level Sigkill action, terminating the thread synchronously before privileges are gained or the syscall returns.
```yaml
# SECURE: Deterministic sub-millisecond in-kernel containment
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: block-container-escape-setns
spec:
  kprobes:
    - call: "sys_enter_setns"
      syscall: true
      args:
        - index: 0
          type: "int"
        - index: 1
          type: "int"
      selectors:
        - matchNamespaces:
            - namespace: Namespace
              operator: NotIn
              values:
                - "kube-system"
          matchActions:
            - action: Sigkill # Synchronous kernel-level kill before syscall execution
    - call: "commit_creds"
      syscall: false
      args:
        - index: 0
          type: "cred"
      selectors:
        - matchArgs:
            - index: 0
              operator: "Equal"
              values:
                - "0" # Intercept unauthorized transitions to uid 0
          matchNamespaces:
            - namespace: Namespace
              operator: In
              values:
                - "production-workloads"
          matchActions:
            - action: Sigkill
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Kubernetes Cluster Context Inspector
Inspects and validates deployed TracingPolicy CRDs, active container capabilities, and namespace bindings in target Kubernetes clusters.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Tetragon CLI & eBPF Event Verifier
Validates Tetragon TracingPolicy schemas and inspects live eBPF kernel sensor telemetry and Sigkill enforcement events.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Deterministic Kernel-Level Process Lineage Container Escape Circuit-Breaker via Cilium Tetragon

Deterministic Kernel-Level Process Lineage Container Escape Circuit-Breaker via Cilium Tetragon defines an industrial-grade behavioral standard for security engineering. Enforces synchronous, sub-millisecond in-kernel process termination via Cilium Tetragon eBPF TracingPolicies whenever privilege escalation or namespace breakout primitives are detected. Eliminates asynchronous userland detection delays by hooking kernel symbols (e.g., commit_creds, setns, cap_capable) and triggering in-kernel Sigkill actions before unauthorized operations can transition process state. Mandates strict validation of binary execution lineage and namespace boundary preservation across all unprivileged workloads. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying on Asynchronous User-Space Auditing or Reactive Telemetry Daemons for Container Escape Mitigation Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftRelying on Asynchronous User-Space Auditing or Reactive Telemetry Daemons for Container Escape MitigationCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS configure Cilium Tetragon TracingPolicy or TracingPolicyNamespaced CRDs with 'action

Engineers MUST ALWAYS configure Cilium Tetragon TracingPolicy or TracingPolicyNamespaced CRDs with 'action: Sigkill' for critical escape primitives rather than purely observational logging ('action: Post').

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST NOT allow unprivileged pods to execute binary lineage transitions that invoke 'setns' into the host or parent namespace hierarchy.

Engineers MUST NOT allow unprivileged pods to execute binary lineage transitions that invoke 'setns' into the host or parent namespace hierarchy.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Policies MUST hook authoritative kernel functions (such as 'commit_creds', 'sys_enter_setns', or 'cap_capable') to intercept privilege alterations synchronously in kernel space before the syscall returns to userland.

Policies MUST hook authoritative kernel functions (such as 'commit_creds', 'sys_enter_setns', or 'cap_capable') to intercept privilege alterations synchronously in kernel space before the syscall returns to userland.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Selectors MUST isolate unprivileged namespaces and explicitly filter against approved binary hashes, parent process IDs (PPID), and execution lineage paths to prevent bypasses via symlink manipulation or binary renaming.

Selectors MUST isolate unprivileged namespaces and explicitly filter against approved binary hashes, parent process IDs (PPID), and execution lineage paths to prevent bypasses via symlink manipulation or binary renaming.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Security manifests MUST define 'matchNamespaces' or workload-specific label selectors to avoid unbounded global kernel traps that could destabilize control-plane or host-level system daemons.

Security manifests MUST define 'matchNamespaces' or workload-specific label selectors to avoid unbounded global kernel traps that could destabilize control-plane or host-level system daemons.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Containers MUST NOT permit override capabilities (CAP_SYS_ADMIN, CAP_SYS_PTRACE, CAP_DAC_OVERRIDE) without dedicated, hardware-isolated Tetragon monitoring policies.

Containers MUST NOT permit override capabilities (CAP_SYS_ADMIN, CAP_SYS_PTRACE, CAP_DAC_OVERRIDE) without dedicated, hardware-isolated Tetragon monitoring policies.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
7

All TracingPolicies MUST be version-controlled in GitOps repositories and validated against the Tetragon custom resource definition schema ('cilium.io/v1alpha1') during CI/CD linting.

All TracingPolicies MUST be version-controlled in GitOps repositories and validated against the Tetragon custom resource definition schema ('cilium.io/v1alpha1') during CI/CD linting.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Deterministic Kernel-Level Process Lineage Container Escape Circuit-Breaker via Cilium Tetragon critical for AI coding assistants?

Enforces synchronous, sub-millisecond in-kernel process termination via Cilium Tetragon eBPF TracingPolicies whenever privilege escalation or namespace breakout primitives are detected. Eliminates asynchronous userland detection delays by hooking kernel symbols (e.g., commit_creds, setns, cap_capable) and triggering in-kernel Sigkill actions before unauthorized operations can transition process state. Mandates strict validation of binary execution lineage and namespace boundary preservation across all unprivileged workloads. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Relying on Asynchronous User-Space Auditing or Reactive Telemetry Daemons for Container Escape Mitigation) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related SECURITY Rules

View all rules →
security
105

OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening

Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.

security
81

WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification

Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.

security
111

Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.

1 Rule in Stack

Deterministic