Podman

Run one long-lived Sensor container per Podman host. The Sensor monitors the host kernel and therefore requires rootful Podman, host namespaces, and kernel mounts.

Sensor and Build Lifecycles

The Sensor container starts once per host and remains running.
Each build container mounts /run/endura, installs only the endura CLI, and runs endura job start and endura job stop.
Build containers do not start another Sensor.

Prerequisites

Podman 4.4 or later on a supported 64-bit Linux host
Root or sudo access; rootless Podman cannot grant the required host kernel access
BTF at /sys/kernel/btf/vmlinux
At least 1 GB of available memory
An Endura license key
Team Server URL and Sensor token for centralized management

Prepare the Host

sudo mkdir -p /run/endura /var/log/endura /etc/endura

Create /etc/endura/sensor.env:

ENDURA_LICENSE_KEY=your_license_key
ENDURA_PROC_PATH=/host/proc
ENDURA_LOG_FILE=/var/log/endura/sensor.log

ENDURA_TEAM_SERVER=https://team-server.example.com
ENDURA_SENSOR_TOKEN=your_sensor_token

Omit the Team Server variables for standalone mode. Protect the file:

sudo chown root:root /etc/endura/sensor.env
sudo chmod 600 /etc/endura/sensor.env

See Configuration for optional variables.

Run the Sensor

sudo podman run -d \
  --name endura-sensor \
  --privileged \
  --pid host \
  --ipc host \
  --env-file /etc/endura/sensor.env \
  -v /proc:/host/proc:ro \
  -v /sys/fs/bpf:/sys/fs/bpf \
  -v /sys/kernel:/sys/kernel:ro \
  -v /sys/kernel/security:/sys/kernel/security:ro \
  -v /run/endura:/run/endura \
  -v /var/log/endura:/var/log/endura \
  -v /etc/os-release:/etc/os-release:ro \
  -v /etc/machine-id:/etc/machine-id:ro \
  -v /tmp:/tmp \
  ghcr.io/endurasecurity/container/endura-sensor:testing \
  sensor start

Run sensor start in the foreground. Quadlet, described below, provides boot persistence.

Required Host Access

Setting	Purpose
`--privileged`	Load eBPF programs and attach kernel hooks
`--pid host`	Resolve control-socket callers and mount namespaces
`--ipc host`	Observe host System V IPC
`/proc` plus `ENDURA_PROC_PATH=/host/proc`	Resolve host processes and workspaces
`/sys/fs/bpf`	Pin eBPF programs and maps
`/sys/kernel`, `/sys/kernel/security`	Read BTF, LSM, and lockdown state
`/run/endura`	Publish the control socket
`/var/log/endura`	Persist logs
`/etc/os-release`, `/etc/machine-id`	Identify the monitored host
`/tmp`	Share the host temporary path used by policies

Do not add :z or :Z to procfs, sysfs, /etc/os-release, or /etc/machine-id. Relabeling these host paths is unsafe and unnecessary for a privileged container.

Both host PID mode and the proc mount are required. A missing setting makes job starts fail with workspace does not exist, including for root.

Verify

sudo podman ps --filter name=endura-sensor
sudo podman exec endura-sensor /endura sensor wait
sudo podman exec endura-sensor /endura sensor status
sudo podman exec endura-sensor /endura sensor hooks
sudo podman logs endura-sensor
ls -l /run/endura/sensor.sock

Confirm the Sensor and deployment appear in Team Server when centrally managed.

Run with Quadlet

Create /etc/containers/systemd/endura-sensor.container:

[Unit]
Description=Endura Runtime Sensor
Wants=network-online.target
After=network-online.target

[Container]
ContainerName=endura-sensor
Image=ghcr.io/endurasecurity/container/endura-sensor:testing
Exec=sensor start
EnvironmentFile=/etc/endura/sensor.env
Volume=/proc:/host/proc:ro
Volume=/sys/fs/bpf:/sys/fs/bpf
Volume=/sys/kernel:/sys/kernel:ro
Volume=/sys/kernel/security:/sys/kernel/security:ro
Volume=/run/endura:/run/endura
Volume=/var/log/endura:/var/log/endura
Volume=/etc/os-release:/etc/os-release:ro
Volume=/etc/machine-id:/etc/machine-id:ro
Volume=/tmp:/tmp
PodmanArgs=--privileged --pid=host --ipc=host

[Service]
Restart=on-failure
RestartSec=5s
TimeoutStartSec=300

[Install]
WantedBy=multi-user.target

Remove the manually started container, load the generated service, and start it:

sudo podman rm --force endura-sensor
sudo systemctl daemon-reload
sudo systemctl start endura-sensor.service
sudo systemctl status endura-sensor.service

The [Install] section makes the generated service part of multi-user.target; do not run systemctl enable on the transient generated unit.

Instrument Build Containers

Mount the host socket, install the CLI, and always stop the job during cleanup:

sudo podman run --rm \
  -v /run/endura:/run/endura \
  -v "$PWD:/workspace" \
  -w /workspace \
  docker.io/redhat/ubi9:latest \
  /bin/sh -c '
    set -e
    curl -sSf https://repo.endurasecurity.com/install/endura-sensor/testing.sh | sh
    cleanup() { endura job stop /workspace --exit-zero; }
    trap cleanup EXIT
    endura sensor wait
    endura job start --workspace /workspace
    # Run build and test commands here.
  '

The workspace must exist and, for a non-root build user, be owned by that user. Provider-specific examples are in Pipeline Security.

Update

With Quadlet:

sudo podman pull ghcr.io/endurasecurity/container/endura-sensor:testing
sudo systemctl restart endura-sensor.service
sudo podman logs endura-sensor

For a manually managed container, remove it and rerun the deployment command after pulling. Review Team Server Compatibility before a major update.

Uninstall

sudo systemctl stop endura-sensor.service
sudo rm -f /etc/containers/systemd/endura-sensor.container
sudo systemctl daemon-reload
sudo podman rm --force endura-sensor
sudo podman rmi ghcr.io/endurasecurity/container/endura-sensor:testing

The host configuration and logs remain. Remove them only after backing up required data and confirming the paths.

Troubleshooting

Container Exits

sudo podman logs endura-sensor
sudo podman inspect endura-sensor
test -r /sys/kernel/btf/vmlinux && echo "BTF available"

Check the license, privileged mode, required mounts, and kernel support.

Job Start Says Workspace Does Not Exist

sudo podman inspect endura-sensor --format '{{.HostConfig.PidMode}}'
sudo podman inspect endura-sensor --format '{{range .Config.Env}}{{println .}}{{end}}' | grep '^ENDURA_PROC_PATH='
sudo podman inspect endura-sensor --format '{{range .Mounts}}{{println .Source "->" .Destination}}{{end}}'

PID mode must be host, ENDURA_PROC_PATH must be /host/proc, and host /proc must map there.

Quadlet Service Is Missing

sudo /usr/lib/systemd/system-generators/podman-system-generator --dryrun
sudo systemctl daemon-reload
sudo systemctl status endura-sensor.service

Correct any reported unit error, then reload systemd.

CLI Cannot Reach the Sensor

Confirm that the Sensor is ready, /run/endura/sensor.sock exists, and the build container mounts /run/endura at the same path.

Oracle Linux RHEL/Alma/Rocky