Tetragon

Cilium is an open-source networking, observability, and security solution for Kubernetes, with an eBPF-based dataplane. As a Container Network Interface (CNI) plugin, it provides overlay or native-routed networking, distributed load balancing, cluster-to-cluster connectivity through Cluster Mesh, and identity-based network policies covering L3 through L7. Its eBPF programs can attach at Linux network I/O, application sockets, and tracepoints; this supports features including kube-proxy replacement, socket-level service load balancing, XDP-based north-south load balancing, DNS- and protocol-aware policy enforcement, and service-mesh functions using IPSec or WireGuard. Cilium also includes Hubble for flow visibility, service maps, and DNS- and protocol-aware observability, with integrations for monitoring systems such as Prometheus and Grafana. The user-space components are licensed under Apache License 2.0, while the BPF code templates are dual-licensed under GPL-2.0-only and the 2-Clause BSD License.

KubeArmor is a runtime security and protection tool for Kubernetes environments that uses Linux security modules to enforce runtime policies and prevent malicious or disallowed commands from executing. Its prevention mode blocks commands at execution time rather than merely alerting afterward; in the demonstrated example, an attempted `ls` command fails.

Kyverno is a Kubernetes-native policy engine for platform engineering teams that manages security, compliance, automation, and governance through policy as code. It uses Kubernetes admission controls and background scans to validate, mutate, generate, and clean up resources, and can verify container image signatures for supply-chain security. Kyverno works with tools including kubectl, Kustomize, and Git; its policies can enforce standards such as Pod Security Standards, security contexts, naming conventions, resource limits, image sources and signatures, and required workload probes. It complements Kubernetes RBAC and native ValidatingAdmissionPolicies and MutatingAdmissionPolicies rather than replacing them, and only enforces requirements explicitly defined in maintained policies.

Falco Talon is a security-response tool that takes automated action when Falco generates an alert, such as killing the affected Kubernetes pod.

kern is a fast, rootless OCI container runtime, sandbox, and virtual resource runtime distributed as a small static binary without a daemon. It creates kernel-enforced containers from OCI images, using user, PID, mount, network, UTS, and IPC namespaces, overlay or read-only roots, a deny-by-default seccomp allowlist, and cgroup v2 limits; the `--security-profile untrusted` option applies the documented hardened bundle. It can also attach named CPU, memory, disk, and device profiles from `kern.toml` to containers, or apply resource caps directly to host processes with optional Landlock write confinement. The project supports container operations, Dockerfile builds, image pull/push and save/load, stack execution through its own or Docker Compose format, and includes Python and Node SDKs plus an MCP server for agents. Its Rust dependency tree uses libc, while image pulling delegates to system `curl` and `tar`; it runs natively on Linux, requires WSL2 on Windows, and needs a Linux virtual machine on macOS.