KubeArmor

KubeArmor is a free, open-source runtime security system for applying policies to cloud-native workloads as they run. It uses Linux Security Modules such as AppArmor, SELinux, and BPF-LSM to restrict process execution, file access, networking operations, and resource use. eBPF supports alerts, telemetry, and container process tracking. Container policies can Allow, Audit, or Block actions, with Block as the default; system-call monitoring is audit-only. Kubernetes policies can use workload metadata and pod labels to target identities, and rules can match paths, network protocols, capabilities, and system calls. The support matrix covers Kubernetes, non-Kubernetes containers, virtual machines, and bare-metal hosts, with environment support depending on operating system, architecture, and enforcement mode. Listed Kubernetes environments include GKE, AKS, OKE, IKS, EKS, OpenShift, Rancher, and DigitalOcean Kubernetes. Project repositories include integrations for OpenTelemetry, Prometheus, Kafka, Grafana, ELK dashboards, GitHub Actions, and Rancher. KubeArmor is community-governed and a CNCF Sandbox project. The installation guide uses Helm and kubectl; some supported environments are observability-only, and VMware Tanzu entries are marked under construction.

KubeArmor provides runtime policy enforcement across several workload types, with Kubernetes identity and label targeting. Its support matrix and audit-only system-call monitoring shape where and how policies can be applied.

It suits teams hardening cloud containers, IoT and edge workloads, or 5G networks that can manage runtime policies on supported environments. Kubernetes operators can target policies using workload metadata and pod labels.

KubeArmor is a free, open-source runtime security project for teams that operate Linux workloads and want to enforce rules while software runs. It is a strong fit for Kubernetes operators who need policies tied to workload labels and identity, though support depends on the environment and system-call monitoring can only audit.

Overview

KubeArmor aims to harden cloud-native workloads by restricting process execution, file access, networking operations, and resource use. Its use of Linux Security Modules makes it a practical choice for teams managing their own infrastructure and runtime policies. The breadth of deployment options is appealing, but the support matrix matters: some combinations provide observability only, and VMware Tanzu entries remain under construction.

Key features

Policies run through AppArmor, SELinux, or BPF-LSM, with eBPF telemetry recording violations and tracking container processes. Container policies can allow, audit, or block activity; blocking is the default. Rules can match process and file paths, network protocols, capabilities, and system calls. System-call monitoring is audit-only, so teams needing prevention at that level will need another control.

Kubernetes policies can use metadata and select pods through labels or label expressions, connecting enforcement to workload identity. That is useful for teams managing changing groups of pods, rather than maintaining rules against individual instances. KubeArmor also documents hardening guidance based on MITRE, STIG, and CIS, and provides integrations for OpenTelemetry, Prometheus, Kafka, Grafana, ELK dashboards, GitHub Actions, and Rancher.

Pricing

KubeArmor is open source and its KubeArmor plan costs nothing. The plan covers the runtime security project, with workload and platform support varying by the support matrix. There are no paid tiers or seat, quota, or renewal terms in this plan; the cost advantage comes with the operational responsibility of running a self-hosted system and checking that the chosen environment supports the enforcement mode you need.

Platforms

KubeArmor supports API and Linux environments and is self-hosted. Its deployment matrix covers Kubernetes, non-Kubernetes containers, virtual machines, and bare-metal hosts. Kubernetes environments include GKE, AKS, OKE, IKS, EKS, OpenShift, Rancher, DigitalOcean, and Alibaba Cloud, among others, with support varying by operating system, architecture, and enforcement mode. RHEL or CentOS 8.4 and earlier on Kubernetes and Oracle Ampere are marked observability-only; those environments provide visibility rather than full policy enforcement.

Installation guidance uses Helm and kubectl to install the KubeArmor Operator on a Kubernetes cluster. That path suits teams already comfortable administering Kubernetes; the broader workload matrix does not remove the need to verify each deployment combination.

Who it's for

KubeArmor suits platform and security teams that can operate Linux controls themselves and want runtime rules for cloud containers, IoT and edge workloads, or 5G networks. Its label-based targeting is particularly useful in Kubernetes environments where policy should follow workloads as they change. Teams that need a managed service, admission control, or blocking of system calls should look elsewhere.

Pros and cons

• Pro: Runtime rules cover process, file, network, capability, and resource behavior, giving operators several ways to constrain workloads.
• Pro: Kubernetes label and identity targeting helps associate policy and telemetry with the workloads that need it.
• Pro: The free, open-source project spans Kubernetes and other workload types, including VMs and bare-metal hosts.
• Con: System-call monitoring is audit-only, which limits its value when prevention is required.
• Con: Support varies by OS, architecture, and enforcement mode, and some environments are observability-only.
• Con: Self-hosted deployment puts installation and ongoing operation on the adopting team.

Alternatives

Trivy is a free, open-source scanner for teams seeking a scanner rather than KubeArmor's runtime enforcement. Tetragon is another free, open-source option for Kubernetes, Linux, and container installations. Kubescape is worth considering for teams looking for an Apache 2.0 CLI and Kubernetes operator they can self-host.

Docker Desktop offers a free Personal plan with Docker Engine and Kubernetes, Docker Hub, Docker Scout, and Docker Debug, while its Pro plan costs $9 a month. Snyk Open Source fits teams looking for software composition analysis: its free plan covers five projects, and Team costs $25 a month. Qualys External Attack Surface Management offers a 30-day trial at $0 for teams evaluating its cybersecurity asset management and external attack surface product.

Deepfence ThreatMapper is a free option whose plan is described as having no limits or hidden features. RapidFort may suit teams wanting five curated near-zero-CVE images from a limited catalog, with daily rebuilds and patching on its free plan.

Verdict

Choose KubeArmor if your team can run a self-hosted Linux security system and wants runtime enforcement connected to Kubernetes workload identity across a range of deployment types. Its open-source plan and policy coverage are compelling for that job. Look elsewhere if your environment falls into an observability-only support case, or if you need managed operation, admission control, or system-call blocking.