Docker

Run one long-lived Runtime Sensor container per Docker host. The container monitors the host kernel, so it requires host namespaces and kernel mounts that an ordinary application container does not.

Runtime Sensor and Build Lifecycles

Keep one Sensor running per host. Build containers use its socket and the CLI for job start/stop; leave their installed Sensor service stopped.

Prerequisites

Docker Engine 24 or later on a supported x86-64 (AMD64) Linux host
Root or sudo access; rootless Docker cannot provide the required host privileges
Linux kernel 5.11 or later with BTF at /sys/kernel/btf/vmlinux
At least 1 GB of available memory
An Endura license key
Team Server URL and Runtime Sensor token for centralized management

Prepare the Host

Create persistent socket, log, and configuration locations:

sudo mkdir -p /run/endura /var/log/endura /etc/endura

Create /etc/endura/sensor.env:

ENDURA_LICENSE_KEY=your_license_key
ENDURA_PROC_PATH=/host/proc
ENDURA_LOG_FILE=/var/log/endura/sensor.log

ENDURA_TEAM_SERVER=https://team-server.example.com
ENDURA_SENSOR_TOKEN=your_sensor_token

Omit the Team Server variables for standalone mode. Protect the file:

sudo chown root:root /etc/endura/sensor.env
sudo chmod 600 /etc/endura/sensor.env

See Configuration for optional variables.

Run the Runtime Sensor

sudo docker run -d \
  --name endura-sensor \
  --restart unless-stopped \
  --privileged \
  --pid host \
  --ipc host \
  --env-file /etc/endura/sensor.env \
  -v /proc:/host/proc:ro \
  -v /sys/fs/bpf:/sys/fs/bpf \
  -v /sys/kernel:/sys/kernel:ro \
  -v /sys/kernel/security:/sys/kernel/security:ro \
  -v /run/endura:/run/endura \
  -v /var/log/endura:/var/log/endura \
  -v /etc/os-release:/etc/os-release:ro \
  -v /etc/machine-id:/etc/machine-id:ro \
  -v /tmp:/tmp \
  ghcr.io/endurasecurity/container/endura-sensor:testing \
  sensor start

Run sensor start in the foreground. The Runtime Sensor is the container’s main process.

Required Host Access

Setting	Purpose
`--privileged`	Load eBPF programs and attach kernel hooks
`--pid host`	Resolve control-socket callers and their mount namespaces
`--ipc host`	Observe host System V IPC
`/proc` plus `ENDURA_PROC_PATH=/host/proc`	Resolve host processes and workspaces
`/sys/fs/bpf`	Pin Runtime Sensor maps
`/sys/kernel`	Read kernel BTF
`/sys/kernel/security`	Inspect LSM and lockdown state
`/run/endura`	Publish the control socket to host and build containers
`/var/log/endura`	Persist Runtime Sensor logs
`/etc/os-release`, `/etc/machine-id`	Identify the monitored host
`/tmp`	Share the host temporary path used by policies

--pid host and the proc mount are both required. If a required procfs, BPF, or securityfs path is absent or is not a directory, the Sensor exits during startup with the affected path. A valid but incorrect procfs root, or missing host PID visibility, can instead make job starts fail with workspace does not exist, even for root and even when the workspace is present.

Verify

sudo docker ps --filter name=endura-sensor
sudo docker exec endura-sensor /endura sensor wait
sudo docker exec endura-sensor /endura sensor status
sudo docker exec endura-sensor /endura sensor hooks
sudo docker logs endura-sensor
ls -l /run/endura/sensor.sock

In Team Server, check Runtime Sensors. Deployments and workloads appear after a manually started workload is reported.

Docker Compose

The same deployment can be expressed as docker-compose.yaml:

services:
  endura-sensor:
    image: ghcr.io/endurasecurity/container/endura-sensor:testing
    container_name: endura-sensor
    command: ["sensor", "start"]
    restart: unless-stopped
    stop_grace_period: 60s
    privileged: true
    pid: host
    ipc: host
    env_file:
      - /etc/endura/sensor.env
    healthcheck:
      test: ["CMD", "/endura", "sensor", "status"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s
    volumes:
      - /proc:/host/proc:ro
      - /sys/fs/bpf:/sys/fs/bpf
      - /sys/kernel:/sys/kernel:ro
      - /sys/kernel/security:/sys/kernel/security:ro
      - /run/endura:/run/endura
      - /var/log/endura:/var/log/endura
      - /etc/os-release:/etc/os-release:ro
      - /etc/machine-id:/etc/machine-id:ro
      - /tmp:/tmp

The image contains no shell, so health checks must use exec form and /endura.

sudo docker compose up -d
sudo docker compose ps

Instrument Build Containers

A build container needs the host socket and the CLI. Always stop the job during cleanup:

docker run --rm \
  -v /run/endura:/run/endura \
  -v "$PWD:/workspace" \
  -w /workspace \
  docker.io/almalinux:10 \
  /bin/sh -c '
    set -e
    dnf install -y curl ca-certificates
    curl -sSf https://repo.endurasecurity.com/install/endura-sensor/testing.sh | sh
    cleanup() {
      build_status=$?
      set +e
      endura job stop /workspace
      cleanup_status=$?
      if [ "$build_status" -ne 0 ]; then
        exit "$build_status"
      fi
      exit "$cleanup_status"
    }
    trap cleanup EXIT
    endura sensor wait
    ENDURA_JOB_ID=$(endura job start --workspace /workspace)
    echo "started endura job with id ${ENDURA_JOB_ID}"
    # Run build and test commands here.
  '

Cleanup preserves build failures and fails successful work on stop errors. The workspace must exist and belong to its non-root user. See provider examples.

Update

Drain protected work before updating; restart jobs after readiness and hook checks. Graceful shutdown attempts telemetry delivery, but exceeding the 60-second stop timeout can force termination and lose pending data.

sudo docker pull ghcr.io/endurasecurity/container/endura-sensor:testing
sudo docker stop --time 60 endura-sensor
sudo docker rm endura-sensor
# Run the same docker run command used for deployment.

For Compose:

sudo docker compose pull endura-sensor
sudo docker compose up -d endura-sensor

Review Team Server Compatibility before a major update.

Uninstall

sudo docker stop --time 60 endura-sensor
sudo docker rm endura-sensor
sudo docker rmi ghcr.io/endurasecurity/container/endura-sensor:testing

The host configuration, logs, and socket directory remain. Remove them only after backing up required data and confirming the paths.

Troubleshooting

Container Exits

sudo docker logs endura-sensor
sudo docker inspect endura-sensor
test -r /sys/kernel/btf/vmlinux && echo "BTF available"

Check the license, required mounts, privileged mode, and kernel support. directory not found: <path> or not a directory: <path> identifies a missing or invalid /sys/fs/bpf, /sys/kernel/security, or configured procfs mount.

Job Start Says Workspace Does Not Exist

sudo docker inspect endura-sensor --format '{{.HostConfig.PidMode}}'
sudo docker inspect endura-sensor --format '{{range .Config.Env}}{{println .}}{{end}}' | grep '^ENDURA_PROC_PATH='
sudo docker inspect endura-sensor --format '{{range .Mounts}}{{println .Source "->" .Destination}}{{end}}'

The PID mode must be host, ENDURA_PROC_PATH must be /host/proc, and the host procfs must be mounted there.

CLI Cannot Reach the Runtime Sensor

Confirm that the Runtime Sensor is ready, /run/endura/sensor.sock exists on the host, and the build container mounts /run/endura at the same path.

Team Server Is Offline

Test https://team-server.example.com/_readiness from the host and confirm outbound TCP 443 and certificate trust.

Debian and Ubuntu Configuration