BPF

The BPF enforcer uses Linux BPF LSM hooks to enforce controls over files, execution, capabilities, network operations, ptrace and mounts. Choose it for the operations exposed by vArmor's BPF rules, not as a general-purpose eBPF programming interface.

Before you start

The prerequisites are Linux 5.10+ on x86_64 or 6.6+ on arm64, containerd 1.6.0+, and an enabled BPF LSM. Enable bpfLsmEnforcer.enabled in the Helm installation after checking the nodes. See Installation; the kernel version alone does not establish that BPF LSM is enabled.

Write a policy

Select BPF as spec.policy.enforcer, or a supported combination. Use the built-in rules and custom BPF rules for the operations you need. DefenseInDepth is not supported with BPF; check the mode documentation before choosing a mode.

BPF network rules control socket and destination properties at the kernel layer. They do not match decrypted HTTP paths, methods or injected headers. Choose NetworkProxy when those application-level controls are needed; check both layers if combining them.

BPF egress rules can also describe destinations using Kubernetes resources: toServices matches Services and their backend endpoints, while toPods matches selected Pods and ports. See NetworkEgressRule for configuration and requirements. Enable Pod Egress Control before using toPods.

Verify and update

Use Writing Policies to select the workload. Check policy and ArmorProfile status, then test permitted and prohibited operations in the actual protected container. Consult Audit Logs to correlate events with the workload.

Rules for a workload already protected by BPF can be updated dynamically. Adding the enforcer to an existing workload and changing its target are separate lifecycle operations; follow Usage Instructions. Verify the affected operations after updating a policy.

Limits and performance

Each node supports BPF protection for up to 256 containers at the same time. Each generated configuration supports up to 64 rules each for files, program execution and networking, and 50 or 64 mount rules, depending on node capabilities. Socket and egress rules share the network limit; built-in and custom rules count together. See Rule counts and node capacity.

Only the operations and matching semantics exposed by vArmor's BPF API are supported. Do not assume that every AppArmor rule has an identical BPF equivalent. Rule-specific limits belong to the custom rule reference, and measurements belong to Performance; measure overhead with your own workload before sizing the deployment.