Deployment

Install the Runtime Sensor directly on Linux, run it in a host container, or deploy it as a Kubernetes DaemonSet.

Supported Platforms

Installation Methods

Native Packages and Archives

Native installs include the CLI, service, and environment file. DEB/RPM upgrades preserve configuration and restart only a previously running Sensor. TGZ upgrades preserve the environment file as 0600, replace CLI/service files, and reload active systemd metadata without restarting; follow the guide’s explicit stop/start steps.

On systemd hosts, endura-kernel-filesystems.service mounts missing bpffs and securityfs before Sensor startup. BTF at /sys/kernel/btf/vmlinux remains required.

The installation script detects the operating system and configures the appropriate package or signed TGZ:

curl -sSf https://repo.endurasecurity.com/install/endura-sensor/testing.sh | sudo sh

Use plain sudo sh; installer startup needs no inherited Sensor configuration.

If the privileged installer must use an HTTP proxy, preserve only the required proxy variables:

curl -sSf https://repo.endurasecurity.com/install/endura-sensor/testing.sh | \
  sudo --preserve-env=HTTP_PROXY,HTTPS_PROXY,NO_PROXY,http_proxy,https_proxy,no_proxy sh

Preserve only required proxy variables, as allowed by host sudo policy. Review the installer under your change-control process.

The installer needs UID 0 or CAP_SYS_ADMIN plus package/filesystem permissions. DEB installs coreutils, curl, gnupg; RPM installs coreutils, gnupg. TGZ requires existing chmod, curl, grep, install, mkdir, mktemp, printf, rm, tar.

Install GPG before any TGZ installation. Without gpg, it warns and skips signature verification. Extraction rejects unexpected members and requires regular CLI, service, and environment files, not symlinks.

Override Installer Detection

Detection uses /etc/os-release: Debian/Ubuntu select DEB; AlmaLinux, Amazon, CentOS, Fedora, Oracle, Rocky, and RHEL’s Fedora-compatible metadata select RPM; others select TGZ.

For a compatible derivative that is not detected correctly, set one override while invoking the installer:

curl -sSf https://repo.endurasecurity.com/install/endura-sensor/testing.sh | \
  sudo ENDURA_USE_DEB=true sh

Overrides are ENDURA_USE_DEB=true, ENDURA_USE_RPM=true, or ENDURA_USE_TGZ=true. Set one compatible format. Multiple true values resolve DEB, then RPM, then TGZ.

Containers

Use ghcr.io/endurasecurity/container/endura-sensor:testing. It monitors the host, requiring host kernel 5.11+, BTF, privileged access, PID visibility, and mounts from the Docker/Podman guide.

Kubernetes

The Helm chart deploys a DaemonSet with only the required Linux capabilities, so each eligible node has one Runtime Sensor. Kubernetes examples pin an explicit channel chart version, whose appVersion selects the matching immutable image.

Release Channels

Native, Docker, Podman, and CI examples use testing. Kubernetes selects the testing chart repository and pins its semantic version. See Release Channels for channel semantics, artifact naming, manifests, and update guidance.

Team Server Compatibility

The Runtime Sensor and Team Server are compatible when their major versions match. Minor and patch versions do not gate compatibility and can be updated in either order.

At startup and every 15 seconds, the Runtime Sensor reads unauthenticated GET /api/version from Team Server. The response has this shape:

{"version":"1.0.85","build":"f57af95c"}

On mismatch, the Sensor warns and keeps enforcing, but stops registration, status, heartbeats, violations, and logs. Version reporting continues. While running, it buffers up to 1,000 logs in memory, dropping newer logs when full. Compatible responses restore submission within 15 seconds without restart.

Telemetry During Team Server Interruptions

Enforcement continues during outages or mismatch; telemetry is best effort. Violations are memory-only. Disabled submissions, failed batches, and queue-overflow events are not replayed. The compatibility buffer above covers logs only.

Graceful shutdown attempts pending delivery without guaranteeing persistence.

Jobs starting without Team Server association stay local and are not rebound. After recovery, stop/start them to retrieve central policy and associate build/workload violations.

Use endura sensor status to distinguish the connectivity results:

• active (online)
• error: <cause>
• active (incompatible: team server <version>)

Status output does not include hook counts. Root can run endura sensor hooks for the per-program attachment list.

For a major upgrade, update Team Server and all Runtime Sensors during the same maintenance window. Either order is supported. ENDURA_VERSION_CHECK=false disables the compatibility gate and should be used only as a temporary last resort.

Enforcement Technology

LSM hooks deny directly; supported fallbacks detect without direct denial. By default, either path can terminate offending tasks. ENDURA_SENSOR_KILL_TASK=false disables termination but retains direct LSM denial. Check status, root-only hooks, and startup logs on each host.

Sensor Restarts and Protection Gaps

Only maps are pinned. Stop, crash, or forced termination detaches programs and ends enforcement. Restarting restores neither active jobs nor their policies. Drain protected work first, then resume only after Sensor readiness, job restart, and hook checks. Graceful shutdown attempts delivery; forced removal can lose buffered telemetry and derived policies.

Service and Hook Troubleshooting

Native Service Overrides

Use the packaged systemd service’s capability set, which includes CAP_SYS_ADMIN. Inspect custom overrides with sudo systemctl cat endura-sensor when hooks fail to attach or jobs fail to start. The Kubernetes chart has its own capability configuration.

Keep RestrictSUIDSGID disabled: it blocks required openat2 calls and causes job-start ENOSYS (Function not implemented). After correcting overrides, run sudo systemctl daemon-reload and sudo systemctl restart endura-sensor; verify jobs and hooks.

Resolver Hook Coverage

Run root-only endura sensor hooks and check that both getaddrinfo_enter and getaddrinfo_exit are attached under the getaddrinfo program. If either is unavailable, inspect the reported error, host PID visibility, the configured host procfs, and access to PID 1’s mapped glibc library. Restart the Sensor after replacing the host glibc library so it can attach to the new copy.

Resolver-hook failure leaves packet DNS observation and connection enforcement available through their own hooks. Review the hostname expansion limits when a connection remains denied after successful name resolution.

Host Requirements

• x86-64 (AMD64) Linux kernel 5.11 or later with BTF data available at /sys/kernel/btf/vmlinux
• Kernel access to load eBPF programs and pin maps
• /sys/fs/bpf, /sys/kernel/security, and the configured procfs root available as directories
• Root privileges to manage the Runtime Sensor
• At least 1 GB of available memory; high-core systems may require more for per-CPU eBPF maps
• Outbound HTTPS to Team Server when centrally managed

Container deployments additionally need host /proc mounted at the configured procfs root and host PID visibility. Follow the container guide exactly because a root-only smoke test can hide an incorrect PID or proc mount configuration.

Team Server Enrollment

Have an Administrator enroll a Runtime Sensor in Team Server, copy its one-time token, and configure:

ENDURA_LICENSE_KEY=your_license_key
ENDURA_TEAM_SERVER=https://team-server.example.com
ENDURA_SENSOR_TOKEN=your_sensor_token

Store these values in the platform-specific secret or environment file. See the configuration reference for optional settings.

Next Steps

Choose the guide for the target host or cluster from the supported-platform table above.