AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
devopscritical PriorityID: cilium-tetragon-ebpf-exec-enforcement

Cilium Tetragon In-Kernel Process Execution and Container Breakout Enforcement

Enforces synchronous, in-kernel process termination via Cilium Tetragon eBPF TracingPolicies before unauthorized system calls return to userspace. Guarantees that container breakout attempts, unauthorized binary execution, and privilege escalations are intercepted at the kernel LSM or tracepoint boundary with Sigkill rather than detected asynchronously after execution completes.

Prohibited Anti-Pattern: Relying on Asynchronous Userspace Audit Logs for Process Execution and Container Escapes

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Cilium Tetragon In-Kernel Process Execution and Container Breakout Enforcement - Enforces synchronous, in-kernel process termination via Cilium Tetragon eBPF TracingPolicies before unauthorized system calls return to userspace. Guarantees that container breakout attempts, unauthorized binary execution, and privilege escalations are intercepted at the kernel LSM or tracepoint boundary with Sigkill rather than detected asynchronously after execution completes.
globs: deploy/**/*.yaml, k8s/**/*.yaml, infrastructure/**/*.yaml, tetragon/**/*.yaml, charts/**/*.yaml
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/cilium-tetragon-ebpf-exec-enforcement"
---

# Cilium Tetragon In-Kernel Process Execution and Container Breakout Enforcement

> **Severity**: CRITICAL | **Category**: devops
> **Anti-Pattern Warning**: Relying on Asynchronous Userspace Audit Logs for Process Execution and Container Escapes

## System Constraints
You are a Principal Security Architect and DevOps Engineer specializing in Cilium Tetragon eBPF kernel enforcement. Mandate synchronous in-kernel blocking via LSM hooks and tracepoints using TracingPolicy and TracingPolicyNamespaced CRDs. Never permit passive audit logging where runtime enforcement is required. Prevent container escapes, privilege escalations, and unauthorized binary launches by enforcing Sigkill actions within kernel space before userspace execution completes.

## Strict Guidelines
- Engineers MUST ALWAYS enforce synchronous termination using `action: Sigkill` on critical policy violations rather than relying on default asynchronous userspace notifications.
- Engineers MUST prioritize Linux Security Module (LSM) hooks such as `security_bprm_check` or `security_file_open` over raw syscall entry tracepoints when enforcing execution barriers to eliminate race conditions.
- TracingPolicies MUST strictly limit scope to target namespaces and pod label selectors using `matchNamespaces` and `matchLabels` to prevent accidental kernel panic or host-level denial of service.
- Engineers MUST explicitly block unauthorized interactive shells (`/bin/sh`, `/bin/bash`, `/bin/zsh`), network diagnostic utilities (`netcat`, `curl`, `wget`), and package managers (`apt`, `apk`, `yum`) within production runtime containers.
- Engineers MUST NOT deploy generic, unbounded wildcards in `matchArgs` or `matchBinaries` without strict absolute path definitions or binary hash/inode anchoring.
- TracingPolicies MUST declare appropriate hook selectors and argument filtering to distinguish between host init processes and workload processes.

## Bad vs Good Implementations
### Tetragon TracingPolicy: In-Kernel Shell and Breakout Execution Prevention

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: This configuration merely logs the sys_execve call to userspace via the BPF ring buffer. Attackers gain immediate interactive shell access or run container breakout exploits (e.g., core_pattern manipulation, nsenter) long before a SIEM or userspace daemon can parse the event and terminate the process.
```yaml
# Insecure: Observability-only audit logging without kernel enforcement
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: audit-shell-execution
spec:
  kprobes:
    - call: "sys_execve"
      syscall: true
      args:
        - index: 0
          type: "string"
      selectors:
        - matchArgs:
            - index: 0
              operator: "Prefix"
              values:
                - "/bin/"
          # Flaw: No action specified, defaults to passive event streaming to tetragon.log.
          # Malicious binary completes execution and initiates container breakout before alerts fire.
```

#### Production Standard (Correct)
> **Standard**: Attaching directly to the LSM hook `security_bprm_check` ensures evaluation occurs in kernel context before the binary is mapped into memory. Using `action: Sigkill` synchronously terminates the thread within kernel space before the syscall returns, while `action: Post` simultaneously sends telemetry for forensics without introducing detection lag.
```yaml
# Secure: Synchronous in-kernel enforcement blocking unauthorized binary execution
apiVersion: cilium.io/v1alpha1
kind: TracingPolicyNamespaced
metadata:
  name: block-unauthorized-exec
  namespace: production
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/part-of: payment-gateway
  kprobes:
    - call: "security_bprm_check"
      syscall: false
      args:
        - index: 0
          type: "linux_binprm"
      selectors:
        - matchArgs:
            - index: 0
              operator: "Postfix"
              values:
                - "/sh"
                - "/bash"
                - "/nc"
                - "/curl"
                - "/wget"
          matchActions:
            - action: Sigkill
            - action: Post
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Kubernetes Cluster Inspector MCP
Inspects and validates Tetragon Custom Resource Definitions and runtime pod security states inside Kubernetes clusters.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Tetragon CLI & BPF Verifier Tool
Command-line interface to live-stream Tetragon events, inspect sensor status, and test in-kernel TracingPolicy filtering.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium Tetragon In-Kernel Process Execution and Container Breakout Enforcement

Cilium Tetragon In-Kernel Process Execution and Container Breakout Enforcement defines an industrial-grade behavioral standard for devops engineering. Enforces synchronous, in-kernel process termination via Cilium Tetragon eBPF TracingPolicies before unauthorized system calls return to userspace. Guarantees that container breakout attempts, unauthorized binary execution, and privilege escalations are intercepted at the kernel LSM or tracepoint boundary with Sigkill rather than detected asynchronously after execution completes. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying on Asynchronous Userspace Audit Logs for Process Execution and Container Escapes Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftRelying on Asynchronous Userspace Audit Logs for Process Execution and Container EscapesCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS enforce synchronous termination using `action

Engineers MUST ALWAYS enforce synchronous termination using `action: Sigkill` on critical policy violations rather than relying on default asynchronous userspace notifications.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST prioritize Linux Security Module (LSM) hooks such as `security_bprm_check` or `security_file_open` over raw syscall entry tracepoints when enforcing execution barriers to eliminate race conditions.

Engineers MUST prioritize Linux Security Module (LSM) hooks such as `security_bprm_check` or `security_file_open` over raw syscall entry tracepoints when enforcing execution barriers to eliminate race conditions.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

TracingPolicies MUST strictly limit scope to target namespaces and pod label selectors using `matchNamespaces` and `matchLabels` to prevent accidental kernel panic or host-level denial of service.

TracingPolicies MUST strictly limit scope to target namespaces and pod label selectors using `matchNamespaces` and `matchLabels` to prevent accidental kernel panic or host-level denial of service.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Engineers MUST explicitly block unauthorized interactive shells (`/bin/sh`, `/bin/bash`, `/bin/zsh`), network diagnostic utilities (`netcat`, `curl`, `wget`), and package managers (`apt`, `apk`, `yum`) within production runtime containers.

Engineers MUST explicitly block unauthorized interactive shells (`/bin/sh`, `/bin/bash`, `/bin/zsh`), network diagnostic utilities (`netcat`, `curl`, `wget`), and package managers (`apt`, `apk`, `yum`) within production runtime containers.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Engineers MUST NOT deploy generic, unbounded wildcards in `matchArgs` or `matchBinaries` without strict absolute path definitions or binary hash/inode anchoring.

Engineers MUST NOT deploy generic, unbounded wildcards in `matchArgs` or `matchBinaries` without strict absolute path definitions or binary hash/inode anchoring.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

TracingPolicies MUST declare appropriate hook selectors and argument filtering to distinguish between host init processes and workload processes.

TracingPolicies MUST declare appropriate hook selectors and argument filtering to distinguish between host init processes and workload processes.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Cilium Tetragon In-Kernel Process Execution and Container Breakout Enforcement critical for AI coding assistants?

Enforces synchronous, in-kernel process termination via Cilium Tetragon eBPF TracingPolicies before unauthorized system calls return to userspace. Guarantees that container breakout attempts, unauthorized binary execution, and privilege escalations are intercepted at the kernel LSM or tracepoint boundary with Sigkill rather than detected asynchronously after execution completes. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Relying on Asynchronous Userspace Audit Logs for Process Execution and Container Escapes) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related DEVOPS Rules

View all rules →
devops
86

Kubernetes Gateway API v1 HTTPRoute Canary and ReferenceGrant Invariants

Enforces strict conformance to Kubernetes Gateway API v1 specifications during migration from legacy Ingress controllers. Mandates explicit ReferenceGrant resources for cross-namespace routing, strict relative integer weighting for HTTPRoute canary releases, and explicit backendRef port declarations.

devops
118

ArgoCD ApplicationSet Matrix Generator Invariants & Cascade Deletion Guards

Enforces strict structural constraints on ArgoCD ApplicationSet Matrix generators combining cluster selectors and Git directories. Prevents catastrophic multi-cluster cascade pruning, accidental secret exposure through parameter interpolation, and runaway Application CR explosion via explicit sync policies, preservation finalizers, and parameter validation.

devops
40

Karpenter Resilient Topology, Interruption Queue, and Consolidation Budget Standard

Enforces deterministic disruption budgets, multi-instance-type diversification, and event-driven SQS interruption queue handling across Karpenter NodePools and EC2NodeClasses. Eliminates cascading eviction loops, instance starvation, and availability downtime during AWS Spot rebalances and underutilized node consolidation.

1 Rule in Stack

Cilium