Commands

The endura CLI controls the Runtime Sensor, jobs, policies, and license.

endura <command> [subcommand] [options]

Use --help for any command. Configuration uses environment variables, validated before execution. The CLI reads its process environment; it does not load /opt/endura/sensor/environ automatically.

endura sensor

endura sensor start

Start the Runtime Sensor and load its eBPF programs. Requires root.

sudo sh -c 'set -a; . /opt/endura/sensor/environ; exec endura sensor start -d'

The privileged shell loads the environment file. Containerized Sensors run in the foreground as the main process.

Native eBPF loading typically takes 15–20 seconds, after provider feed attempts finish. Include HTTP timeouts and retries in your readiness timeout.

endura sensor wait

Wait until the Runtime Sensor has loaded eBPF programs and is accepting control-socket requests. It prints ok on success.

Use this readiness barrier before starting a job:

endura sensor wait && endura job start --workspace "$WORKSPACE"

No root privilege is required.

endura sensor status

Print the current Team Server connectivity result:

Status reads the connectivity verdict cached every 15 seconds and returns immediately. It requires no root access and exits nonzero only if the Sensor is not running. Check root-only sensor hooks separately for coverage.

endura sensor stop

Stop all jobs, then stop the Runtime Sensor. Requires root. Derive-mode jobs print their derived policies while stopping.

Use as unconditional cleanup when an ephemeral runner started its own Sensor. It also stops jobs and attempts telemetry delivery; failed submissions are not replayed.

endura sensor logs

Read Runtime Sensor logs. Requires root because logs contain telemetry from every user.

endura sensor hooks

List each loaded eBPF program and whether it attached. Requires root.

sudo endura sensor hooks

An unattached or unloaded row means that hook does not provide coverage. Review other hooks for the same operation before assessing enforcement coverage.

For resolver expansion, both getaddrinfo_enter and getaddrinfo_exit must attach. Failure detaches the pair without preventing startup; packet DNS and connection enforcement use separate hooks.

endura job

Commands that select an existing job accept its 16-digit hexadecimal ID or workspace path. If neither is provided, the CLI detects the current CI/CD workspace.

Exactly 16 hexadecimal characters always means a job ID; prefix a similarly named workspace with ./. Workspace lookup uses the caller’s mount namespace and the originally resolved object/path. Use the printed ID across namespaces or after path changes.

endura job start

Start monitoring a workspace and print its job ID.

endura job start --workspace "$WORKSPACE"

Default policy lookup uses the CLI’s current directory, independently of --workspace. Select an absolute path when the policy is elsewhere:

endura job start --workspace /srv/build --policy /etc/endura/policies/build.json

The CLI validates the local policy before requesting job startup. A missing explicit file or invalid selected file fails startup even if Team Server has a valid assigned policy.

Starting a job on a workspace that already has one replaces it after validation. Use the same start command when a workspace needs a new policy or mode.

If a symlink, hard link, or bind mount resolves to a workspace owned by another active job, job start fails with workspace object is already registered by another job. The existing job and policy remain active; stop that job before registering the alias.

Every workspace must exist. A non-root user may start a job only for a workspace owned by that user. Root bypasses the ownership check, not the existence check.

For centrally managed builds, Team Server can replace the selected local policy after the provider and pipeline match succeeds. See Policy Management for the exact precedence and offline behavior.

endura job stop

Stop a job. A derive-mode job prints its pruned policy.

On job start, --policy is an input. On job stop, it is an output for one selected job and cannot be combined with --all, --after, or --duration.

# Stop by workspace.
endura job stop /workspace

# Save a derived policy.
endura job stop /workspace --policy .endura/policy.json

# Stop jobs older than two hours.
endura job stop --all --duration 2h

--all, --after, and --duration cannot be combined with a positional job value.

Durations must be nonnegative and cannot exceed 9223372036854775807 seconds after converting the suffix. Invalid or oversized values are rejected before any jobs are stopped.

endura job get

Print the selected job as JSON, including its metadata and policy:

endura job get /workspace

endura job list

List authorized running jobs with ID, UID, KIND, MODE, STARTED, and WORKSPACE columns.

endura job status

Print active when the selected job exists. Otherwise, exit nonzero.

endura policy

endura policy validate

Validate policy JSON and rule semantics without starting a job:

endura policy validate .endura/policy.json

Success prints <path>: valid (mode:<mode>). Errors include file, line, column, and a caret at the invalid value.

endura policy describe

Print the policy used by a running job. Pass its 16-digit job ID:

endura policy describe 3f9a1c7e5b2d8046

A derive-mode policy is pruned before output.

endura license

endura license verify

Validate ENDURA_LICENSE_KEY from the current process environment. Success prints ok. For a native installation, explicitly load the root-only environment file:

sudo sh -c 'set -a; . /opt/endura/sensor/environ; exec endura license verify'

This command independently validates the key. It is not required after the Runtime Sensor starts successfully and reports ready.

endura license info

Print details as JSON for ENDURA_LICENSE_KEY from the current process environment. Like license verify, this command does not inspect the running Runtime Sensor or automatically load its environment file. The Runtime Sensor warns within 90 days of expiration.

endura version

Print <version>+<build>, for example 1.0.121+a1b2c3d. Compatibility compares only the major version; minor, patch, and build metadata after + do not gate compatibility.

Policy Modes

Authorization

For a containerized Runtime Sensor, host PID visibility and ENDURA_PROC_PATH=/host/proc are required for workspace authorization. See Configuration.

Exit Codes

Commands exit nonzero on errors. Two controls override this:

• ENDURA_EXIT_ZERO=true affects every command.
• --exit-zero affects only endura sensor stop and endura job stop.

Errors still print to standard error.