eBPF Audit
Container isolation is a hypothesis, not a guarantee. A zero-install audit that probes your own infrastructure for the kernel capabilities that quietly break it.
No 0-day
Default capabilities are enough
Runs anywhere
Docker, Podman, K8s, CI runners
Zero install
One container, one report
Isolation you never tested.
Container fences — cgroups, seccomp, AppArmor, SELinux — are assumed to hold. But a process holding capabilities like CAP_SYS_ADMIN or CAP_BPF can use the shared kernel as a side door: reading a neighbour tenant’s files and secrets, reconstructing traffic, and slipping past audit logs, with no disk writes, no packets and no exploit.
These capabilities persist by default in real CI/CD runners and orchestrators. The exposure is not a novel CVE; it is a configuration nobody checked.
Test the boundary, then close it.
01
Probe for latent privilege
A self-contained audit container inspects the host and its neighbours for the dangerous capabilities and kernel exposure that enable cross-boundary observation — CAP_SYS_ADMIN, CAP_BPF, CAP_DAC_READ_SEARCH, CAP_NET_ADMIN and their kin.
02
Runs where you deploy
Zero-config, it runs on Docker, Podman, Kubernetes nodes and CI runners. You run it against infrastructure you own and operate, and it hands back a plain report of what leaks.
03
Findings map to fixes
Every finding points at a concrete mitigation: rootless containers, tighter seccomp and AppArmor profiles, disabling unprivileged eBPF, and dropping capabilities that were never needed in the first place.
A working audit.
| Milestone | Status | Evidence |
|---|---|---|
| Capability + kernel-exposure probe | Running | Audit container |
| Docker / Podman / K8s / CI coverage | In progress | Broadening |
| Mitigation guidance | In progress | Mapped to findings |
| CI/CD gate mode | Next | — |
eBPF Audit is a defensive tool for testing infrastructure you own and operate. Figures are internal measurements at proof-of-concept stage.
From audit to gate.
The tool grows from a one-shot audit into a CI/CD gate that fails a build when a runner exposes dangerous capabilities — so the check runs on every deploy rather than once.
eBPF Audit spins out of Research ByIQ once it runs cleanly across the major container platforms and orchestrators.