Skip to content

Runtime & eBPF security

What a container actually does at execution time, and how to see and stop the bad parts: eBPF and the kernel security model, seccomp/AppArmor/SELinux and capability hardening, Falco detection and tuning, Tetragon and Cilium in-kernel enforcement, and container-escape techniques with detection and a runtime incident-response runbook.

Advanced5 sections · 15 lessons · ~9h total · 60-question self-test

01

eBPF & kernel foundations

3 lessonsTest yourself

01eBPF for runtime securitySandboxed kernel programs, maps, and the verifier.35 min 02LSM & mandatory access controlWhere SELinux/AppArmor and BPF-LSM hook in.30 min 03Kernel events & enrichmentThe syscalls that matter, plus container context.30 min

02

Kernel hardening & isolation

3 lessonsTest yourself

01seccomp syscall filteringRuntimeDefault and custom default-deny profiles.30 min 02AppArmor & SELinuxPath-based and label-based container confinement.35 min 03Capabilities, namespaces & cgroupsDrop ALL, non-root, and the isolation primitives.30 min

03

Falco & runtime detection

3 lessonsTest yourself

01Falco runtime detectionDriver, engine, rules; shells in containers.35 min 02Tuning Falco for signalScoped exceptions, custom rules, low noise.30 min 03Routing & automated responseFalcosidekick, Talon, isolate on critical.30 min

04

Enforcement: Tetragon & Cilium

3 lessonsTest yourself

01Tetragon in-kernel enforcementTracingPolicy and synchronous Sigkill.35 min 02Cilium network policy & HubbleIdentity-based L3–L7, default-deny, encryption.35 min 03Detect vs enforce, safelyThe spectrum and a waved rollout.30 min

05

Container escapes & IR

3 lessonsTest yourself

01Container escape pathsPrivileged, hostPath, sockets, caps, runtime CVEs.35 min 02Detecting escapes at runtimeThe behavioral signatures and fast containment.30 min 03Runtime incident responseIsolate, preserve, hunt persistence, recover.35 min

Progress is saved in this browser only — no account required.

Final exam

Test yourself on everything

60 questions drawn from all 5 sections — every answer explained as you pick.

Start final exam