DOCSEARCHbyAlgolia
Submit Docs

vArmor Documentation

website·Indexed 31 days ago

https://www.varmor.org

A cloud-native container hardening tool for enforcing security policies. vArmor provides multiple enforcers including BPF, AppArmor, Seccomp, and NetworkProxy to control file access, program execution, system calls, and outbound TCP traffic via VarmorPolicy and VarmorClusterPolicy objects.

Tokens
117.9K
Snippets
291
Records
750
Agent score
54%

What's inside vArmor

  1. Overview of vArmor container hardening

    v0.10

    vArmor is a cloud-native container hardening system designed to enhance container isolation, reduce the kernel attack surface, and implement L4/L7 outbound network access control. It is particularly useful for multi-tenant clusters, protecting critical business workloads, mitigating high-risk vulnerabilities, and securing AI Agent/LLM applications against prompt injection or data exfiltration.

    Key capabilities include:

    • Kernel-level control: Uses AppArmor LSM, BPF LSM, and Seccomp to control file access, process execution, and system calls.
    • NetworkProxy Enforcer: A Sidecar-based proxy (Envoy) that provides transparent interception of outbound traffic, supporting TLS MITM termination, HTTPS decryption, HTTP header injection, and domain filtering (L4/L7).
    • Security Models: Primarily supports an 'Allow-by-Default' model to minimize performance impact and maximize usability, though it also supports 'Deny-by-Default' (whitelist) policies.
    • Behavior Modeling: Allows users to model workload behavior to create precise whitelist policies or identify applicable built-in rules.

  2. Overview of vArmor security capabilities

    vArmor is designed to harden containers by managing security profiles and enforcing network access control. It addresses the complexity of manually writing and managing LSM (Linux Security Module) and Seccomp profiles in Kubernetes environments.

    Key capabilities include:

    • Security Profile Management: Manages AppArmor, BPF, and Seccomp profiles to reduce the kernel attack surface and prevent container escape or lateral movement.
    • Network Egress Control: Uses a NetworkProxy enforcer based on an Envoy Sidecar to enforce L4/L7 access control on container network egress traffic.
    • Behavior Modeling: Utilizes BPF and Audit technologies to collect application behaviors and generate models to assist in building security policies.
    • Flexible Policy Modes: Supports three enforcement effects: interception only, interception with alarm, and alarm only.

  3. Overview of vArmor container security capabilities

    vArmor is a security tool for Kubernetes that simplifies the management of container security policies. It addresses the difficulty of manually creating AppArmor, BPF, and Seccomp profiles by providing multiple policy modes, built-in rules, and behavior modeling based on BPF and Audit technology.

    Key capabilities include:

    • Security Profile Management: Automatically manages AppArmor, BPF, and Seccomp profiles for workloads.
    • Network Access Control: Provides a NetworkProxy enforcer based on Envoy Sidecar for L4/L7 outbound traffic control.
    • Behavior Modeling: Collects application behavior to assist in generating security policies.
    • Flexible Enforcement: Supports three operational effects: block violations, block and alert, or alert only.

  4. Overview of vArmor NetworkProxy capabilities

    v0.10

    NetworkProxy manages redirected outbound TCP traffic via a vArmor-managed Envoy sidecar. It allows developers to restrict HTTP requests, filter TLS destinations using Server Name Indication (SNI), perform HTTPS inspection via TLS interception (MITM), and inject upstream authentication headers (e.g., Authorization) based on the domain. These headers can be configured directly or sourced from Kubernetes Secrets.

    Traffic Inspection Capabilities:

    • Plain HTTP/1.1 and HTTP/2 (h2c): Inspects Destination IP/port, HTTP Host, path, and method. Audit granularity is at the HTTP request level.
    • TLS Passthrough: Inspects Destination IP/port and visible TLS SNI. Audit granularity is at the connection level (no decrypted HTTP data).
    • HTTPS (MITM Intercepted): Inspects Destination IP/port and decrypted HTTP Host, path, and method. Audit granularity is at the HTTP request level.
    • Other TCP Traffic: Inspects Destination IP/port. Audit granularity is at the connection level.

    Limitations:

    • Does not inspect UDP or QUIC traffic.
    • Does not act as a DNS policy engine.
    • Does not provide request-body classification, prompt-injection detection, or application-process attribution.

  5. Overview of vArmor container hardening

    vArmor is a cloud-native container hardening system designed to strengthen container isolation, reduce kernel attack surfaces, and enforce network egress access control (L4/L7) within Kubernetes clusters. It is particularly useful for multi-tenant environments, protecting critical business containers, mitigating high-risk vulnerabilities when patching is delayed, and securing AI Agents/LLM applications against prompt injection and data exfiltration.

    Key capabilities include:

    • Kernel-level MAC: Integration with AppArmor LSM, BPF LSM, and Seccomp.
    • Network Control: An Envoy-based Network Proxy for L4/L7 access control, including TLS MITM for HTTPS inspection and HTTP header injection.
    • Security Model: Primarily uses an 'Allow-by-Default' model where only explicitly declared behaviors are blocked to minimize performance impact.

  6. Overview of vArmor Policy Tools

    vArmor provides a suite of tools to assist security engineers in generating and refining security policies. These tools are designed to reduce the manual effort involved in crafting effective mitigation rules while ensuring that engineers maintain control over final deployment decisions. The primary tools include the Policy Advisor and the Vulnerability Policy Generator.

  7. Overview of vArmor Custom Rule Qualifiers and Actions

    v0.10
    vArmor allows custom access control rules in EnhanceProtect and DefenseInDepth modes. Different enforcers use different qualifiers to determine the action (DENIED or AUDIT). Note that ALLOWED is not a qualifier; it only occurs in DefenseInDepth mode when allowViolations=true for accesses not covered by an allow-list.
    EnforcerQualifiersResulting Action
    AppArmorallow / deny / auditDENIED / AUDIT
    BPFdeny / auditDENIED / AUDIT
    NetworkProxyallow / deny / auditDENIED / AUDIT

  8. Overview of vArmor BPF Enforcer

    v0.10
    The BPF enforcer uses Linux BPF LSM hooks to control file access, program execution, capabilities, network operations, ptrace, and mount operations. It is an implementation of vArmor rules and is not a general-purpose eBPF programming interface.

  9. Overview of vArmor core business hardening features

    vArmor is designed for hardening containerized applications in Kubernetes environments. Key features include:

    • Cloud-native Design: Follows the Kubernetes operator pattern for ease of integration into DevSecOps workflows.
    • Dynamic Flexibility: Supports multiple operating modes (AlwaysAllow, RuntimeDefault, EnhanceProtect) that can be switched without restarting workloads. It offers three action levels: intercept, intercept and alarm, and alarm-only.
    • Out-of-the-box Rules: Provides built-in rules based on ByteDance's security practices and automatically manages AppArmor, BPF, and Seccomp profiles in Allow-by-Default mode.
    • Policy Assistance: Includes behavior modeling and a policy advisor to lower the barrier for creating effective security policies.

  10. Overview of vArmor NetworkProxy

    NetworkProxy is a vArmor enforcer that controls redirected outbound TCP traffic using a managed Envoy sidecar. It allows developers to restrict HTTP requests, filter TLS destinations via Server Name Indication (SNI), perform HTTPS inspection through Man-in-the-Middle (MITM) interception, and inject upstream authentication headers (e.g., Authorization) based on the domain. These headers can be configured directly or sourced from Kubernetes Secrets.

  11. Overview of vArmor Custom Rule Enforcers

    vArmor allows custom access control rules in EnhanceProtect and DefenseInDepth modes. Different enforcers use different qualifiers to determine the action (DENIED or AUDIT) taken when a rule is triggered. Note that ALLOWED is not a qualifier; it only occurs in DefenseInDepth mode when allowViolations=true.
    EnforcerQualifiersResulting Actions
    AppArmorallow / deny / auditDENIED / AUDIT
    BPFdeny / auditDENIED / AUDIT
    NetworkProxyallow / deny / auditDENIED / AUDIT

  12. Overview of vArmor container hardening

    v0.10

    vArmor is a cloud-native container hardening system designed for Kubernetes. It strengthens container isolation and reduces the kernel attack surface by leveraging several enforcers: AppArmor LSM, BPF LSM, Seccomp, and a Network Proxy (Envoy-based sidecar).

    Key use cases include:

    • Multi-tenant environments where hardware virtualization is too costly.
    • Protecting critical business containers against privilege escalation, escapes, or lateral movement.
    • Mitigating high-risk vulnerabilities when immediate patching is not possible.
    • Securing AI Agents and LLM-based applications by controlling outbound network access to prevent data exfiltration or prompt injection-induced abuse.