Enterprise Linux eBPF Runtime Security: Real-Time Threat Detection with Cilium Tetragon & Falco Architecture

Legacy Linux host security relied entirely on user-space daemons polling /proc or receiving streaming netlink events from the Linux Audit framework (auditd). In production Kubernetes clusters running thousands of high-throughput containers, auditd imposes a crippling 15% to 30% CPU penalty, drops critical syscall events under burst traffic, and remains vulnerable to kernel-space blind spots. Even worse, user-space detection tools cannot prevent zero-day lateral movement—they only alert after the reverse shell has already connected. Extended Berkeley Packet Filter (eBPF) transforms Linux runtime defense from reactive post-compromise log auditing into proactive, in-kernel observability and autonomous process termination. In this architectural guide, we dissect how to build a production eBPF runtime security pipeline using Cilium Tetragon for in-kernel execution filtering and Falco for behavioral event streaming.

1. The Problem: The Collapse of User-Space Monitoring and auditd Under Scale

Linux runtime security tools historically operated outside the kernel, creating fundamental latency and performance bottlenecks that modern adversaries exploit during container breakout attacks. User-space log scrapers cannot keep pace with ephemeral container lifecycles and microsecond-level process spawns.

When high-concurrency containerized workloads handle thousands of transactions per second, traditional user-space audit mechanisms fail along three critical fault lines:

• Severe Syscall Interception Overhead: Every syscall evaluated by auditd triggers a context switch between user space and kernel space. Benchmarks under heavy I/O demonstrate CPU utilization spikes between 15% and 35%, forcing engineering teams to disable syscall auditing on high-traffic database and API nodes.
• Buffer Exhaustion and Silent Event Dropping: Under burst conditions (e.g., automated CI/CD runs or brute-force scanning), the kernel audit ring buffer overflows. When auditd fails to drain events fast enough, the kernel silently drops telemetry, leaving zero audit records of adversary actions.
• Time-of-Check to Time-of-Use (TOCTOU) Exploits: Because user-space monitors inspect processes asynchronously after syscall completion, an adversary wielding an automated payload can execute malicious code, spawn a subprocess, and unlink the executable binary before the detection daemon even parses the telemetry.

2. Architectural Blueprint: The Linux Kernel eBPF Telemetry Pipeline

The eBPF runtime architecture operates by attaching sandboxed, bytecode programs directly to kernel tracepoints, kprobes (kernel function entry), kretprobes (kernel function exit), and Linux Security Module (LSM) hooks without modifying the underlying kernel source code.

When an application executes a critical syscall—such as sys_execve, sys_connect, or sys_ptrace—the execution flow follows a hardened cryptographic pipeline:

1. Hook Attachment: The eBPF verification engine validates the safety of the bytecode program during loading. The bytecode attaches directly to kernel probes or LSM BPF hooks (available natively in Linux kernels 5.8+ with BPF Type Format enabled).
2. In-Kernel Filtering: Unlike legacy tools that dump all raw events to user space, eBPF programs filter telemetry inside kernel memory using high-speed eBPF BPF Maps. Irrelevant processes are discarded before leaving the kernel, reducing inter-layer context switching by up to 98%.
3. Ring Buffer Transport: Matching security violations stream into a lockless BPF_MAP_TYPE_RINGBUF. This shared-memory ring buffer streams structured JSON/Protobuf events directly to user-space collectors without locking overhead.
4. Synchronous In-Kernel SIGKILL: When configuring Cilium Tetragon with an LSM policy, the kernel does not simply emit an alert—it executes an immediate kernel-level SIGKILL or returns -EPERM, killing the unauthorized process before the syscall completes.

3. Production Implementation: Deploying Cilium Tetragon with Helm

Deploying Cilium Tetragon across a production Kubernetes cluster requires configuring the Tetragon DaemonSet with persistent ring buffers, export filters, and proper Linux kernel capability grants.

Step 1: Verify Linux Kernel Compatibility and BPF Type Format (BTF)

Before deployment, confirm that your worker node operating system (Ubuntu 22.04 LTS, RHEL 9, Amazon Linux 2023, or Flatcar) provides kernel 5.4+ and native BTF support:

# Check running kernel version
uname -r

# Verify that BPF Type Format (BTF) is enabled in the kernel
ls -l /sys/kernel/btf/vmlinux

# Confirm BPF LSM support is compiled into the active kernel
cat /sys/kernel/security/lsm

Step 2: Deploy Tetragon via Helm with Production Resource Tuning

Deploy the official Tetragon Helm chart into the dedicated kube-system namespace with tuned ring buffer memory allocations:

# Add the Cilium official Helm repository
helm repo add cilium https://helm.cilium.io
helm repo update

# Install Tetragon with production export filters
helm install tetragon cilium/tetragon -n kube-system 
  --set tetragon.exportAllow='{"event_type":["PROCESS_EXEC","PROCESS_EXIT","PROCESS_KPROBE"]}' 
  --set tetragon.resources.requests.cpu="100m" 
  --set tetragon.resources.requests.memory="256Mi" 
  --set tetragon.resources.limits.cpu="1000m" 
  --set tetragon.resources.limits.memory="1024Mi" 
  --set tetragon.bpf.mapBufferSize=65536

Step 3: Verify Tetragon DaemonSet Health and Telemetry Streaming

# Confirm all Tetragon agent pods are running across worker nodes
kubectl get ds -n kube-system tetragon

# Stream live real-time process execution events from a worker node
kubectl exec -ti -n kube-system ds/tetragon -c tetragon -- tetra getevents -o compact

4. Deep Enforcement: Writing Tetragon TracingPolicies for In-Kernel Process Termination

Tetragon TracingPolicy CRDs define declarative kernel-level security rules that monitor specific kernel symbols and enforce actions such as telemetry capture or synchronous process termination via Sigkill.

Scenario 1: Blocking Reverse Shells and Unauthorized Interactive Binaries

Production container pods running microservices should never spawn interactive shells (/bin/bash, /bin/sh, nc, python). The following policy terminates any process attempting to execute a shell inside the production-workloads namespace instantly:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: block-container-interactive-shells
  namespace: production-workloads
spec:
  kprobes:
    - call: "sys_execve"
      syscall: true
      args:
        - index: 0
          type: "string"
      selectors:
        - matchArgs:
            - index: 0
              operator: "Prefix"
              values:
                - "/bin/sh"
                - "/bin/bash"
                - "/usr/bin/nc"
                - "/usr/bin/python"
          matchNamespaces:
            - "production-workloads"
          matchActions:
            - action: Sigkill

Scenario 2: Preventing Sensitive File Exfiltration (/etc/shadow and Service Account Tokens)

Attackers who compromise a container attempt to steal the projected Kubernetes ServiceAccount token from /var/run/secrets/kubernetes.io/serviceaccount/token. The following policy monitors the security_file_open LSM hook and blocks read access from unauthorized binaries:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: protect-service-account-tokens
spec:
  kprobes:
    - call: "security_file_open"
      syscall: false
      args:
        - index: 0
          type: "file"
      selectors:
        - matchArgs:
            - index: 0
              operator: "Postfix"
              values:
                - "/serviceaccount/token"
                - "/etc/shadow"
          matchBinaries:
            - operator: "NotIn"
              values:
                - "/usr/local/bin/app-binary"
          matchActions:
            - action: Sigkill

5. Falco Runtime Rule Engineering: Detecting Namespace Escapes and Privilege Escalation

Falco rules complement in-kernel process termination by analyzing behavioral patterns across the entire container infrastructure, forwarding enriched security alerts to SIEM platforms (Splunk, Elastic) or Slack webhooks.

Deploying Falco via Helm with Modern eBPF Driver

# Add Falcosecurity Helm repository
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update

# Install Falco utilizing the modern eBPF probe driver
helm install falco falcosecurity/falco -n falco --create-namespace 
  --set driver.kind=modern_ebpf 
  --set tty=true 
  --set falco.json_output=true 
  --set falco.priority=warning

Custom Production Falco Rule: Detecting Container Namespace Escapes (CVE-2024-21626 / runc)

Add the following custom rule into your Falco configuration to detect attempts by adversaries to access host namespaces via nsenter or suspicious /proc directory traversal:

# custom-falco-rules.yaml
- rule: Container Namespace Escape Attempt
  desc: Detects an attempt to join a host namespace or traverse /proc/1/ns from within a container
  condition: >
    spawned_process and container and
    (proc.name in (nsenter, unshare) or
     proc.cmdline contains "/proc/1/ns/" or
     proc.args contains "--target 1")
  output: >
    CRITICAL: Container namespace escape attempted!
    (user=%user.name user_id=%user.uid container_id=%container.id
    container_name=%container.name pod=%k8s.pod.name image=%container.image.repository
    cmdline=%proc.cmdline parent=%proc.pname)
  priority: CRITICAL
  tags: [security, container, mitre_privilege_escalation, T1611]

6. Production Troubleshooting & Kernel Diagnostics

7. Production Checklist & Architecture Recommendations

• Standardize on Kernel 5.8+: Mandate worker nodes running Linux kernel 5.8 or higher with BPF Type Format (BTF) and BPF LSM enabled to support in-kernel process termination.
• Combine Tetragon and Falco: Use Cilium Tetragon for low-latency, in-kernel blocking (Sigkill) of obvious malicious binaries, and Falco for macro-level behavioral alerting and SIEM ingestion.
• Integrate with Ingress Hardening: Pair host-level eBPF monitoring with edge ingress filtering by following our guide on Kubernetes Ingress Hardening with Cilium eBPF & Gateway API.
• Connect to Service Mesh Zero Trust: Ensure your node-level eBPF policies integrate seamlessly with application mutual TLS using Istio Ambient Mesh & Sidecarless mTLS.
• Harden Host Linux Identities: Restrict shell access on host nodes by configuring hardware keys as detailed in Enterprise Linux Identity: SSSD, AD Realm & FIDO2 Hardening.

8. Frequently Asked Questions (FAQ)