Open-source eBPF agent that monitors network, process, DNS, and file activity on CI/CD runners. Detect and block supply chain attacks in real-time at the kernel level.
kntrl attaches eBPF programs to kernel hooks, giving you deep visibility and enforcement across network, process, DNS, TLS, and file activity — all from a single binary.
Intercept IPv4/IPv6 TCP and UDP connections via eBPF kprobes. Block based on destination IP, domain, CIDR range, and process identity. Per-process network profiles let you restrict what each tool can access.
Build a real-time process tree from fork/exec events. Block suspicious chains like npm→node→curl that indicate postinstall script attacks. Track full ancestry for every event.
Capture DNS queries and responses at the kernel level. Track which domains each process resolves, restrict DNS server usage, and populate the forward DNS cache for accurate connection attribution.
Extract Server Name Indication from TLS ClientHello packets via eBPF cgroup hooks. Enable domain-based policy enforcement even for encrypted traffic without breaking TLS.
Monitor access to sensitive paths (SSH keys, cloud credentials, Kubernetes secrets). Protect critical system files from writes. Detect environment variable inheritance at exec time.
All decisions flow through an embedded Open Policy Agent with Rego rules. Extend policies with custom .rego files. Cached evaluation with 30-second TTL for zero overhead on hot paths.
kntrl uses eBPF to observe system activity at the kernel level, evaluates events against OPA policies in userspace, and enforces decisions back through BPF maps.
11 eBPF programs attach to kprobes, tracepoints, and cgroup hooks at startup. Zero kernel modules, zero dependencies — just a single static binary.
Kernel-side programs emit events through 6 ring buffers: network (IPv4/IPv6), DNS, process (fork/exec), file access, and TLS SNI extraction.
Userspace goroutines read each ring buffer, enrich events with process ancestry and DNS context, then evaluate against the OPA policy engine.
Passing connections get their IP added to BPF allow maps. Blocked process chains receive SIGKILL. The cgroup egress filter drops packets to unauthorized destinations.
When a malicious npm postinstall or pip setup.py tries to exfiltrate tokens or download payloads, kntrl detects the suspicious process chain and blocks it at the kernel level.
Add kntrl to any GitHub Actions workflow with built-in defaults for npm, pip, GitHub, and common CDNs. No configuration required for monitor mode.
Pre-configured allowlists for npm, PyPI, GitHub, Cloudflare, and Fastly. Default blocked chains for postinstall attacks. DNS server restrictions.
Enable or disable each protection layer independently: network, process, DNS, file, and OPA supply chain rules. Add custom overrides per-input.
Automatic stop action produces summary tables with event counts, blocked connections, process ancestry chains, and file access details.
Bring your own YAML rules files, directories, or .rego policies. Define per-process network profiles, additional blocked chains, and custom alerting via webhooks.
kntrl compiles eBPF programs into the binary at build time using bpf2go. No kernel headers, no DKMS, no containers — just drop the binary and run.