Enforcers: overview and selection
Choose an enforcer from the behavior you need to control, then check the node and workload prerequisites. An enforcer supplies the enforcement mechanism; a policy mode and its rules determine the permitted behavior.
| Goal | Start with | Main consideration |
|---|---|---|
| Restrict file access and program execution | AppArmor or BPF | The corresponding Linux LSM must be enabled on the nodes |
| Restrict system calls | Seccomp | Changes to the profile require new containers |
| Restrict socket operations at the kernel layer | AppArmor or BPF | Check the network rule types supported by each enforcer |
| Restrict destination IPs/ports at the kernel layer | BPF | Supports destination IP/port matching and Kubernetes targets through toServices and toPods |
| Restrict HTTP requests or TLS destinations; inspect HTTPS using MITM | NetworkProxy | Injected containers, traffic redirection and, for MITM, application trust are required |
Choose a mode and scope
Use Policy Modes to select a supported mode. EnhanceProtect adds targeted restrictions; DefenseInDepth uses an allowlist where supported. BehaviorModeling is experimental and must be enabled explicitly; it is not supported with NetworkProxy. BPF does not support DefenseInDepth.
A VarmorPolicy selects workloads in its namespace. A VarmorClusterPolicy has cluster scope and takes precedence over a matching namespaced policy. Start with a dedicated namespace and a narrow target. See Writing Policies.
Combining enforcers
Supported combinations, such as AppArmorSeccomp and AppArmorNetworkProxy, can address different behaviors within one policy. Each component still has its own prerequisites, update behavior and audit semantics. A combination does not make an unsupported mode available, and permission at one enforcement layer does not override a denial at another.
Consult the enforcer field reference before choosing a combination. NetworkProxy applies network rules at Pod scope; containers in the same Pod share the network namespace.
Next steps
- Check Installation for environment requirements and enabled components.
- Follow Writing Policies to build and verify a policy.
- Use Usage Instructions for status and operations, and Metrics for component monitoring.