Podman

Run one long-lived Runtime Sensor container per Podman host. The Runtime Sensor monitors the host kernel and therefore requires rootful Podman, host namespaces, and kernel mounts.

Runtime Sensor and Build Lifecycles

Keep one Sensor running per host. Build containers use its socket and the CLI for job start/stop; leave their installed Sensor service stopped.

Prerequisites

• Podman 4.4 or later on a supported x86-64 (AMD64) Linux host
• Root or sudo access; rootless Podman cannot grant the required host kernel access
• Linux kernel 5.11 or later with BTF at /sys/kernel/btf/vmlinux
• At least 1 GB of available memory
• An Endura license key
• Team Server URL and Runtime Sensor token for centralized management

Prepare the Host

sudo mkdir -p /run/endura /var/log/endura /etc/endura

Create /etc/endura/sensor.env:

ENDURA_LICENSE_KEY=your_license_key
ENDURA_PROC_PATH=/host/proc
ENDURA_LOG_FILE=/var/log/endura/sensor.log

ENDURA_TEAM_SERVER=https://team-server.example.com
ENDURA_SENSOR_TOKEN=your_sensor_token

Omit the Team Server variables for standalone mode. Protect the file:

sudo chown root:root /etc/endura/sensor.env
sudo chmod 600 /etc/endura/sensor.env

See Configuration for optional variables.

Run the Runtime Sensor

sudo podman run -d \
  --name endura-sensor \
  --privileged \
  --pid host \
  --ipc host \
  --env-file /etc/endura/sensor.env \
  -v /proc:/host/proc:ro \
  -v /sys/fs/bpf:/sys/fs/bpf \
  -v /sys/kernel:/sys/kernel:ro \
  -v /sys/kernel/security:/sys/kernel/security:ro \
  -v /run/endura:/run/endura \
  -v /var/log/endura:/var/log/endura \
  -v /etc/os-release:/etc/os-release:ro \
  -v /etc/machine-id:/etc/machine-id:ro \
  -v /tmp:/tmp \
  ghcr.io/endurasecurity/container/endura-sensor:testing \
  sensor start

Run sensor start in the foreground. Quadlet, described below, provides boot persistence.

Required Host Access

Do not add :z or :Z to procfs, sysfs, /etc/os-release, or /etc/machine-id. Relabeling these host paths is unsafe and unnecessary for a privileged container.

Both host PID mode and the proc mount are required. If a required procfs, BPF, or securityfs path is absent or is not a directory, the Sensor exits during startup with the affected path. A valid but incorrect procfs root, or missing host PID visibility, can instead make job starts fail with workspace does not exist, including for root.

Verify

sudo podman ps --filter name=endura-sensor
sudo podman exec endura-sensor /endura sensor wait
sudo podman exec endura-sensor /endura sensor status
sudo podman exec endura-sensor /endura sensor hooks
sudo podman logs endura-sensor
ls -l /run/endura/sensor.sock

In Team Server, check Runtime Sensors. Deployments and workloads appear after a manually started workload is reported.

Run with Quadlet

Create /etc/containers/systemd/endura-sensor.container:

[Unit]
Description=Endura Runtime Sensor
Wants=network-online.target
After=network-online.target

[Container]
ContainerName=endura-sensor
Image=ghcr.io/endurasecurity/container/endura-sensor:testing
Exec=sensor start
EnvironmentFile=/etc/endura/sensor.env
Volume=/proc:/host/proc:ro
Volume=/sys/fs/bpf:/sys/fs/bpf
Volume=/sys/kernel:/sys/kernel:ro
Volume=/sys/kernel/security:/sys/kernel/security:ro
Volume=/run/endura:/run/endura
Volume=/var/log/endura:/var/log/endura
Volume=/etc/os-release:/etc/os-release:ro
Volume=/etc/machine-id:/etc/machine-id:ro
Volume=/tmp:/tmp
PodmanArgs=--privileged --pid=host --ipc=host --stop-timeout=60

[Service]
ExecStop=/usr/bin/podman stop --ignore --time 60 endura-sensor
Restart=on-failure
RestartSec=5s
TimeoutStartSec=300
TimeoutStopSec=90

[Install]
WantedBy=multi-user.target

The explicit stop command gives the Sensor up to 60 seconds to drain pending telemetry. The example uses PodmanArgs for compatibility with Podman 4.4, which does not support the StopTimeout Quadlet key.

Stop the manually started container gracefully, remove it, then load and start the generated service:

sudo podman stop --time 60 endura-sensor
sudo podman rm endura-sensor
sudo systemctl daemon-reload
sudo systemctl start endura-sensor.service
sudo systemctl status endura-sensor.service

The [Install] section makes the generated service part of multi-user.target; do not run systemctl enable on the transient generated unit.

Instrument Build Containers

Mount the host socket, install the CLI, and always stop the job during cleanup:

sudo podman run --rm \
  -v /run/endura:/run/endura \
  -v "$PWD:/workspace" \
  -w /workspace \
  docker.io/almalinux:10 \
  /bin/sh -c '
    set -e
    dnf install -y curl ca-certificates
    curl -sSf https://repo.endurasecurity.com/install/endura-sensor/testing.sh | sh
    cleanup() {
      build_status=$?
      set +e
      endura job stop /workspace
      cleanup_status=$?
      if [ "$build_status" -ne 0 ]; then
        exit "$build_status"
      fi
      exit "$cleanup_status"
    }
    trap cleanup EXIT
    endura sensor wait
    ENDURA_JOB_ID=$(endura job start --workspace /workspace)
    echo "started endura job with id ${ENDURA_JOB_ID}"
    # Run build and test commands here.
  '

Cleanup preserves build failures and fails successful work on stop errors. The workspace must exist and belong to its non-root user. See provider examples.

Update

Drain protected work before updating; restart jobs after readiness and hook checks. Graceful shutdown attempts telemetry delivery, but exceeding the 60-second stop timeout can force termination and lose pending data.

With Quadlet:

sudo podman pull ghcr.io/endurasecurity/container/endura-sensor:testing
sudo systemctl restart endura-sensor.service
sudo podman logs endura-sensor

For a manually managed container, run sudo podman stop --time 60 endura-sensor, then sudo podman rm endura-sensor, and rerun the deployment command after pulling. Review Team Server Compatibility before a major update.

Uninstall

For Quadlet, stop the service and remove its source definition. Quadlet removes its managed container:

sudo systemctl stop endura-sensor.service
sudo rm /etc/containers/systemd/endura-sensor.container
sudo systemctl daemon-reload

For a manually managed container:

sudo podman stop --time 60 endura-sensor
sudo podman rm endura-sensor

After either method, remove the image if it is no longer needed:

sudo podman rmi ghcr.io/endurasecurity/container/endura-sensor:testing

The host configuration and logs remain. Remove them only after backing up required data and confirming the paths.

Troubleshooting

Container Exits

sudo podman logs endura-sensor
sudo podman inspect endura-sensor
test -r /sys/kernel/btf/vmlinux && echo "BTF available"

Check the license, privileged mode, required mounts, and kernel support. directory not found: <path> or not a directory: <path> identifies a missing or invalid /sys/fs/bpf, /sys/kernel/security, or configured procfs mount.

Job Start Says Workspace Does Not Exist

sudo podman inspect endura-sensor --format '{{.HostConfig.PidMode}}'
sudo podman inspect endura-sensor --format '{{range .Config.Env}}{{println .}}{{end}}' | grep '^ENDURA_PROC_PATH='
sudo podman inspect endura-sensor --format '{{range .Mounts}}{{println .Source "->" .Destination}}{{end}}'

PID mode must be host, ENDURA_PROC_PATH must be /host/proc, and host /proc must map there.

Quadlet Service Is Missing

sudo /usr/lib/systemd/system-generators/podman-system-generator --dryrun
sudo systemctl daemon-reload
sudo systemctl status endura-sensor.service

Correct any reported unit error, then reload systemd.

CLI Cannot Reach the Runtime Sensor

Confirm that the Runtime Sensor is ready, /run/endura/sensor.sock exists, and the build container mounts /run/endura at the same path.