Runtime Sensor
The Runtime Sensor monitors Linux operations and applies security policies to CI/CD builds and workloads. It can derive rules, report violations, or enforce a reviewed policy.
Deployment Options
| Method | Use it for |
|---|---|
| Native package | Linux hosts and CI/CD runners |
| Docker | Docker-managed hosts |
| Podman | Podman-managed hosts |
| Kubernetes | One Sensor per eligible node |
Requirements
Use x86-64 Linux with kernel 5.11 or later, BTF, root access, at least 1 GB available memory, and an Endura license. Each deployment guide supplies the required capabilities, mounts, and verification commands.
Operating Modes
For standalone use, set ENDURA_LICENSE_KEY. For central management, also set ENDURA_TEAM_SERVER and an Administrator-issued Sensor token. Team Server receives telemetry and supplies assigned pipeline policies; workload policies remain local.
Try a Local Policy
After starting the Sensor, run this block outside CI/CD:
(
set -e
workspace=$(mktemp -d)
policy=$(mktemp)
printf '{"mode":"derive"}\n' >"$policy"
printf 'Workspace: %s\nPolicy: %s\n' "$workspace" "$policy"
endura sensor wait
endura job start --workspace "$workspace" --policy "$policy"
trap 'status=$?; endura job stop "$workspace" --policy "$policy" || :; exit "$status"' EXIT
(cd "$workspace" && printf 'hello from Endura\n' >message.txt && cat message.txt)
endura job stop "$workspace" --policy "$policy"
trap - EXIT
endura policy validate "$policy"
)Startup prints a job ID; the demo prints hello from Endura; validation reports valid. Failures stop the block and attempt cleanup of a started job. Inspect the printed policy path, then remove both temporary paths when finished.
Policy Workflow
Review the derived rules, test representative runs in observe mode, then switch to enforce only after resolving unexplained violations. Follow the policy lifecycle for refinement and mode changes.
How It Works
The Sensor evaluates file, network, process, kernel, memory, and container operations through eBPF hooks. Hook coverage determines whether it can deny an operation directly or terminate a task after detection. See enforcement behavior and policy defaults.