Docker

Run one long-lived Sensor container per Docker host. The container monitors the host kernel, so it requires host namespaces and kernel mounts that an ordinary application container does not.

Sensor and Build Lifecycles

The Sensor container starts once per host and remains running.
Each build container mounts /run/endura, installs only the endura CLI, and runs endura job start and endura job stop.
Build containers do not start another Sensor.

Prerequisites

Docker Engine 24 or later on a supported 64-bit Linux host
Root or sudo access; rootless Docker cannot provide the required host privileges
BTF at /sys/kernel/btf/vmlinux
At least 1 GB of available memory
An Endura license key
Team Server URL and Sensor token for centralized management

Prepare the Host

Create persistent socket, log, and configuration locations:

sudo mkdir -p /run/endura /var/log/endura /etc/endura

Create /etc/endura/sensor.env:

ENDURA_LICENSE_KEY=your_license_key
ENDURA_PROC_PATH=/host/proc
ENDURA_LOG_FILE=/var/log/endura/sensor.log

ENDURA_TEAM_SERVER=https://team-server.example.com
ENDURA_SENSOR_TOKEN=your_sensor_token

Omit the Team Server variables for standalone mode. Protect the file:

sudo chown root:root /etc/endura/sensor.env
sudo chmod 600 /etc/endura/sensor.env

See Configuration for optional variables.

Run the Sensor

sudo docker run -d \
  --name endura-sensor \
  --restart unless-stopped \
  --privileged \
  --pid host \
  --ipc host \
  --env-file /etc/endura/sensor.env \
  -v /proc:/host/proc:ro \
  -v /sys/fs/bpf:/sys/fs/bpf \
  -v /sys/kernel:/sys/kernel:ro \
  -v /sys/kernel/security:/sys/kernel/security:ro \
  -v /run/endura:/run/endura \
  -v /var/log/endura:/var/log/endura \
  -v /etc/os-release:/etc/os-release:ro \
  -v /etc/machine-id:/etc/machine-id:ro \
  -v /tmp:/tmp \
  ghcr.io/endurasecurity/container/endura-sensor:testing \
  sensor start

Run sensor start in the foreground. The Sensor is the container’s main process.

Required Host Access

Setting	Purpose
`--privileged`	Load eBPF programs and attach kernel hooks
`--pid host`	Resolve control-socket callers and their mount namespaces
`--ipc host`	Observe host System V IPC
`/proc` plus `ENDURA_PROC_PATH=/host/proc`	Resolve host processes and workspaces
`/sys/fs/bpf`	Pin Sensor programs and maps
`/sys/kernel`	Read kernel BTF
`/sys/kernel/security`	Inspect LSM and lockdown state
`/run/endura`	Publish the control socket to host and build containers
`/var/log/endura`	Persist Sensor logs
`/etc/os-release`, `/etc/machine-id`	Identify the monitored host
`/tmp`	Share the host temporary path used by policies

--pid host and the proc mount are both required. A missing setting makes job starts fail with workspace does not exist, even for root and even when the workspace is present.

Verify

sudo docker ps --filter name=endura-sensor
sudo docker exec endura-sensor /endura sensor wait
sudo docker exec endura-sensor /endura sensor status
sudo docker exec endura-sensor /endura sensor hooks
sudo docker logs endura-sensor
ls -l /run/endura/sensor.sock

When centrally managed, confirm the Sensor and deployment appear in Team Server.

Docker Compose

The same deployment can be expressed as docker-compose.yaml:

services:
  endura-sensor:
    image: ghcr.io/endurasecurity/container/endura-sensor:testing
    container_name: endura-sensor
    command: ["sensor", "start"]
    restart: unless-stopped
    privileged: true
    pid: host
    ipc: host
    env_file:
      - /etc/endura/sensor.env
    healthcheck:
      test: ["CMD", "/endura", "sensor", "status"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s
    volumes:
      - /proc:/host/proc:ro
      - /sys/fs/bpf:/sys/fs/bpf
      - /sys/kernel:/sys/kernel:ro
      - /sys/kernel/security:/sys/kernel/security:ro
      - /run/endura:/run/endura
      - /var/log/endura:/var/log/endura
      - /etc/os-release:/etc/os-release:ro
      - /etc/machine-id:/etc/machine-id:ro
      - /tmp:/tmp

The image contains no shell, so health checks must use exec form and /endura.

sudo docker compose up -d
sudo docker compose ps

Instrument Build Containers

A build container needs the host socket and the CLI. Always stop the job during cleanup:

docker run --rm \
  -v /run/endura:/run/endura \
  -v "$PWD:/workspace" \
  -w /workspace \
  docker.io/redhat/ubi9:latest \
  /bin/sh -c '
    set -e
    curl -sSf https://repo.endurasecurity.com/install/endura-sensor/testing.sh | sh
    cleanup() { endura job stop /workspace --exit-zero; }
    trap cleanup EXIT
    endura sensor wait
    endura job start --workspace /workspace
    # Run build and test commands here.
  '

The workspace must exist and, for a non-root build user, be owned by that user. Provider-specific examples are in Pipeline Security.

Update

sudo docker pull ghcr.io/endurasecurity/container/endura-sensor:testing
sudo docker rm --force endura-sensor
# Run the same docker run command used for deployment.

For Compose:

sudo docker compose pull endura-sensor
sudo docker compose up -d endura-sensor

Review Team Server Compatibility before a major update.

Uninstall

sudo docker rm --force endura-sensor
sudo docker rmi ghcr.io/endurasecurity/container/endura-sensor:testing

The host configuration, logs, and socket directory remain. Remove them only after backing up required data and confirming the paths.

Troubleshooting

Container Exits

sudo docker logs endura-sensor
sudo docker inspect endura-sensor
test -r /sys/kernel/btf/vmlinux && echo "BTF available"

Check the license, required mounts, privileged mode, and kernel support.

Job Start Says Workspace Does Not Exist

sudo docker inspect endura-sensor --format '{{.HostConfig.PidMode}}'
sudo docker inspect endura-sensor --format '{{range .Config.Env}}{{println .}}{{end}}' | grep '^ENDURA_PROC_PATH='
sudo docker inspect endura-sensor --format '{{range .Mounts}}{{println .Source "->" .Destination}}{{end}}'

The PID mode must be host, ENDURA_PROC_PATH must be /host/proc, and the host procfs must be mounted there.

CLI Cannot Reach the Sensor

Confirm that the Sensor is ready, /run/endura/sensor.sock exists on the host, and the build container mounts /run/endura at the same path.

Team Server Is Offline

Test https://team-server.example.com/_readiness from the host and confirm outbound TCP 443 and certificate trust.

Debian and Ubuntu Fedora Linux