Repository navigation
Deploy the runtime sensor anywhere: containers, Kubernetes, VMs, Windows, PaaS, serverless #71
Description
Part of #51. The sensor (#67) and probes must run wherever the user's apps run, not only on Kubernetes, and rolling them out must not require changing an app's code or start command.
Deployment modes:
| Mode | Where | How the probe reaches the sensor (#73) |
|---|---|---|
| Sidecar | Kubernetes pod, AWS ECS/Fargate task, Google Cloud Run (multi-container), Azure Container Apps, Nomad task group, Docker Compose | Unix socket on a shared volume, or tcp://127.0.0.1 in a shared network namespace |
| Host daemon | VMs and bare metal: Linux (systemd), Windows (Windows Service), macOS (launchd). Also Docker hosts running many containers, by mounting the socket into each. | Unix socket or Windows named pipe |
| Direct (no sensor process) | AWS Lambda, Azure Functions, Google Cloud Functions, and single-process PaaS (Heroku, Azure App Service, Elastic Beanstalk, Render) | the probe POSTs to secfoo serve (#66) itself. For Lambda, also ship the sensor as a Lambda Extension layer, so batching happens outside the function. |
| Offline | CI, staging test runs, air-gapped environments | a file, read later with secfoo runtime ingest |
Probe injection, no code change:
| Runtime | How | Issue |
|---|---|---|
| Python | PYTHONPATH + sitecustomize.py |
#55 |
| Node.js | NODE_OPTIONS=--require … / --import … |
#56 |
| JVM | JAVA_TOOL_OPTIONS=-javaagent:… |
#74 |
| .NET | DOTNET_STARTUP_HOOKS, plus CORECLR_PROFILER* for function hits |
#75 |
| Ruby | RUBYOPT=-r… |
#77 |
| PHP | auto_prepend_file, plus an optional extension .ini |
#78 |
| Go / Rust / native | none for inventory. The sensor reads the binary and attaches uprobes. | #76 |
Opt-in only (rule 0 in #51):
- No default installation anywhere. The Secfoo CLI packages and image contain no probe hooks, and the sensor image and examples are separate artifacts that the user deploys deliberately.
- No automatic injection. There is no cluster-wide webhook by default. If an injector is added later, it acts only on workloads labelled
secfoo.com/sensor: enabled. - A probe that is present but not enabled (
SECFOO_SENSORunset or0) does nothing: it loads no hooks and opens no connections. - Removing the sidecar, or unsetting
SECFOO_SENSOR, fully turns it off.
Generate, don't guess: secfoo sensor manifest --platform kubernetes|ecs|cloud-run|compose|systemd --project <id> --app <name> --env <env> prints the exact snippet to add: the sidecar, env vars, and a secret reference for the same API key (#66). The DevOps engineer reviews it and applies it themselves.
Deliverables:
- Sensor binaries for Linux, macOS and Windows on amd64 and arm64, built by the existing release pipeline.
- Container images:
secfoo-sensor, andsecfoo-probe(all runtime probes under/opt/secfoo/probe/<runtime>/, used by an init container orCOPY --from). Both multi-arch, non-root, with read-only root filesystems. - Examples under
examples/runtime/:kubernetes/(init container, sidecar, Helm chart or Kustomize component patching an existing Deployment)ecs/(task definition)cloud-run/(multi-container service YAML)compose/,systemd/windows/(service install and uninstall script)lambda/(layer and extension)
- Docs:
docs/RUNTIME.md, covering:- a matrix of runtime × deployment mode, with what each combination supports
- every env var
- measured overhead per runtime
- exactly what is and isn't collected
- how to disable and uninstall
Done when:
- The Compose example runs end to end in CI (sample app → sensor →
secfoo serve→ evidence row). - The Kubernetes manifests pass
kubectl apply --dry-run=serveron a kind cluster. - The Windows service installs, runs and uninstalls in a Windows CI job.
- Lambda direct mode and the extension are tested with the Lambda runtime interface emulator.
- The ECS and Cloud Run examples are validated against their schemas.
Activity
[-]Deploy the runtime sensor: Kubernetes sidecar, Compose, systemd[/-][+]Deploy the runtime sensor anywhere: containers, Kubernetes, VMs, Windows, PaaS, serverless[/+]