Runtime Enforcer

Beta

Control what can run inside your Kubernetes workloads.

Learn normal process execution and block unexpected executables using eBPF in the Linux kernel. Rules apply to each container separately. In this example, the init container can run Bash, while the application container can run payments-api but not Bash.

Read the docs View on GitHub

Why Runtime Enforcer?

Learn from real workloads

Observe the processes your workloads actually run, and get a policy proposal generated automatically for each one.

Roll out safely

Start in monitor mode and see violations reported before you switch a workload to enforcement.

Enforce at runtime

Use eBPF to block executables that are not on a workload's allow-list.

Kubernetes-native

Manage policies as Kubernetes resources, and export violation events through OpenTelemetry.

Learn. Monitor. Protect.

A simple workflow to secure your workloads.

Learn

Observe normal process execution and generate a policy proposal.

Observing…

/usr/bin/payments-api
/usr/bin/nginx
/usr/bin/worker
/usr/bin/curl
…

Monitor

Detect unexpected executions without breaking your workload.

Violation detected

/bin/bash

podName: payments-api

containerName: app

action: monitor

timestamp: 2026-09-16T14:23:11Z

Protect

Block unexpected executions using eBPF.

Execution blocked

/bin/bash

podName: payments-api

containerName: app

action: protect

timestamp: 2026-09-16T14:24:03Z

From observation to policy

Runtime Enforcer learns from your workloads and generates a policy proposal that you can review and enforce.

WorkloadPolicyProposal (generated)

workloadpolicyproposal.yaml

apiVersion: runtimeenforcer.kubewarden.io/v1alpha1
kind: WorkloadPolicyProposal
metadata:
  name: deploy-payments-api
  namespace: default
spec:
  rulesByContainer:
    init-setup:
      executables:
        allowed:
          - /bin/bash
          - /usr/bin/curl
    app:
      executables:
        allowed:
          - /usr/bin/payments-api

WorkloadPolicy (enforced)

workloadpolicy.yaml

apiVersion: runtimeenforcer.kubewarden.io/v1alpha1
kind: WorkloadPolicy
metadata:
  name: deploy-payments-api
  namespace: default
spec:
  mode: protect
  rulesByContainer:
    init-setup:
      executables:
        allowed:
          - /bin/bash
          - /usr/bin/curl
    app:
      executables:
        allowed:
          - /usr/bin/payments-api

Ready to try it?

Deploy Runtime Enforcer and learn the behavior of your first workload.

# Requires cert-manager and cert-manager-csi-driver - see the quickstart
helm repo add kubewarden https://charts.kubewarden.io

helm install runtime-enforcer kubewarden/runtime-enforcer \
  --namespace runtime-enforcer --create-namespace \
  --wait

Follow the quickstart

Explore other Kubewarden components

Extend your security posture across the entire workload lifecycle.

Admission Controller

Stop unsafe workloads before they enter your cluster.

Stable Learn more

Network Enforcer

Discover network activity and secure the communication between your workloads.

Experimental Learn more

SBOM Scanner

Find vulnerabilities in the container images running inside your cluster.

Beta Learn more

Originally developed by

Kubewarden is a CNCF Sandbox Project