Deep Dive: eBPF Runtime Monitoring
How to build safe, read-only kernel probes for container security.
What eBPF actually gives you
eBPF runs small, verified programs inside the Linux kernel without a kernel module or a patched kernel. Before a program loads, the in-kernel verifier rejects anything that could loop forever, read out of bounds, or touch memory it should not. That property is what makes it safe to attach code to hot paths like the syscall boundary.
ECRSM is an educational, read-only runtime monitor built on that boundary: kernel eBPF probes, a Go agent, and a React dashboard. It is a synthetic teaching stack, not a production EDR, the point is to make kernel-level visibility legible.
Where it hooks
ECRSM attaches to kernel tracepoints rather than kprobes, because tracepoints keep a stable ABI across kernel versions:
| Tracepoint | Signal |
|---|---|
execve | Process execution, the primary lens on reverse shells and suspicious binaries |
connect | Outbound connections, C2 beaconing and exfiltration destinations |
ptrace | Process injection and debugger attach |
mmap | Executable-memory mappings, a signal for shellcode staging |
The data path
- ▹Kernel space, a C eBPF program fires on each tracepoint and copies *metadata only* (PID, UID,
comm, argv sizes, destination address) into a ring buffer. Never payloads, never secrets. - ▹User space, a Go agent drains the ring buffer, enriches each event with container and Kubernetes metadata (pod, namespace, image), and evaluates lightweight rules.
- ▹Dashboard, events stream to a React UI over WebSockets, so a syscall in the kernel becomes a row on screen in real time.
Deployment is a Kubernetes DaemonSet via a Helm chart, so exactly one probe runs per node.
Safety is the whole design
Writing to the kernel is how you crash a machine. ECRSM never does it:
- ▹Read-only introspection, tracepoints observe; they do not modify syscall arguments or packet data.
- ▹Metadata only, no payload bytes, no environment variables, no file contents leave the kernel.
- ▹Least privilege, the agent runs with
CAP_BPF/CAP_SYS_ADMINand nothing more. - ▹Synthetic simulations, the "attacks" it surfaces (reverse shells, process injection, suspicious execs) are safe scripted scenarios, so you learn the detection without a real intrusion.
What it is not
ECRSM is a learning platform. It ships no signatures, blocks nothing, and makes no claim to catch a determined attacker. Its value is pedagogical: it turns the abstract idea of kernel observability into events you can watch on infrastructure you can tear down.