Configuration
The Runtime Sensor reads ENDURA_* environment variables.
| Deployment | Where to set variables |
|---|---|
| Native package | /opt/endura/sensor/environ |
| Docker or Podman | An environment file passed to the container |
| Kubernetes | Helm sensor.env values and the endura-sensor-secrets Secret |
Required
| Variable | Description |
|---|---|
ENDURA_LICENSE_KEY | Sensor license key. Required in standalone and Team Server modes. |
For Team Server mode, also set:
| Variable | Description |
|---|---|
ENDURA_TEAM_SERVER | Fully qualified Team Server URL |
ENDURA_SENSOR_TOKEN | Enrollment token created for this Sensor in Team Server |
Team Server and the Sensor must share a major version. See Team Server Compatibility.
Container Requirement
| Variable | Value | Description |
|---|---|---|
ENDURA_PROC_PATH | /host/proc | Host procfs path inside a Docker or Podman Sensor container |
Docker and Podman must also bind-mount /proc at /host/proc and use the host PID namespace. Either missing setting causes endura job start to fail with workspace does not exist, including for root, because every workspace must resolve before a job starts.
The Helm chart configures host procfs and PID visibility automatically.
Optional Variables
| Variable | Default | Description |
|---|---|---|
ENDURA_BATCHER_AUTOFLUSH | false | Submit violations immediately instead of batching. Use true for ephemeral CI runners. |
ENDURA_EXIT_ZERO | false | Make CLI commands exit 0 after reporting an error. Prefer per-command --exit-zero where available. |
ENDURA_HTTP_TIMEOUT | 5 | Team Server HTTP timeout in seconds. |
ENDURA_JOB_TIMEOUT | disabled | Purge jobs after a duration such as 30m, 2h, or 1d. 0 disables the limit. |
ENDURA_LOG_FILE | /var/log/endura/sensor.log | Log file path. |
ENDURA_LOG_FORMAT | text | File format: text or newline-delimited json. Standard output and submitted logs remain text. |
ENDURA_LOG_LEVEL | info | trace, debug, info, warn, or error. |
ENDURA_SENSOR_KILL_TASK | true | Set false to report enforced violations without terminating the offending task. |
ENDURA_SENSOR_MAX_CLIENTS | 256 | Maximum concurrent control-socket clients. 0 disables the cap. |
ENDURA_SENSOR_POLICY_NOCACHE | false | Re-evaluate repeated events instead of caching policy outcomes. Diagnostic use increases CPU usage. |
ENDURA_SENSOR_TIMEOUT | 10 | Seconds allowed to deliver a complete control-socket request. 0 disables the deadline. |
ENDURA_TLS_PIN | — | PEM file containing the only CA roots trusted for Team Server. |
ENDURA_TLS_VERIFY | true | Verify Team Server certificates. Set false only for temporary testing. |
ENDURA_VERSION_CHECK | true | Enforce same-major Team Server compatibility. Set false only as a temporary last resort. |
Control-Socket Limits
The control socket accepts local unprivileged job requests and authorizes them after reading the request. Keep ENDURA_SENSOR_TIMEOUT and ENDURA_SENSOR_MAX_CLIENTS enabled to bound stalled or excessive clients.
At the default client cap of 256:
- one non-root UID may hold at most 64 connections; and
- 32 connections remain reserved for root.
Both shares scale from ENDURA_SENSOR_MAX_CLIENTS. Native packages set systemd TasksMax=512; raise it if you increase the client cap much beyond 480. Container deployments use their runtime PID limit.
TLS Pinning
When ENDURA_TLS_PIN is set, the Sensor trusts only certificates that chain to a CA in that PEM file. A missing or empty file fails closed. The setting has no effect when ENDURA_TLS_VERIFY=false.