Core Features
Multiple enforcers, flexible policies, ready for production
Cloud-Native
Follows the Kubernetes Operator design pattern, allowing users to harden specific workloads by manipulating the CRD API.
Multiple Enforcers
Provides AppArmor, BPF, Seccomp, and NetworkProxy enforcers that can be used individually or combined to control file access, process execution, network egress, and syscalls.
Network Proxy
Transparently intercepts container egress traffic via an Envoy sidecar, enabling L4/L7/TLS SNI access control with audit logging and dynamic policy updates — no Pod restart required.
AI Agent Protection
Defense-in-depth for AI Agent workloads — enforce access control from syscalls to network protocols, mitigating prompt injection-induced tool abuse and data exfiltration.
Allow-by-Default
Only explicitly declared behaviors will be blocked, which effectively minimizes performance impact and enhances usability.
Deny-by-Default
Enforces an allowlist policy where only explicitly permitted behaviors are allowed, providing the strongest security posture for sensitive workloads.
Built-in Rules
Features a range of built-in rules ready to use out of the box, eliminating the need for expertise in security profile creation.
Behavior Modeling
Supports behavior modeling for workloads to develop allowlist profiles and guide configurations to adhere to least privilege.
Architecture
How vArmor protects your workloads
vArmor primarily consists of two components: the Manager and the Agent. The Manager is responsible for responding to and managing policy objects, while the Agent handles the management of enforcers and profiles on Nodes.
vArmor also supports the NetworkProxy enforcer, which injects an Envoy sidecar proxy and an init container into target Pods via the mutation webhook. The init container sets up iptables rules to redirect egress traffic to the Envoy sidecar, which then enforces L4/L7 access control policies generated by the Manager and delivered via ConfigMap.
With VarmorPolicy or VarmorClusterPolicy objects, users can harden specific workloads and decide which enforcers and rules to use. The ArmorProfile CR acts as an internal interface used for profile management.
Quick Start
Get up and running in minutes
1. Fetch chart
helm pull oci://elkeid-ap-southeast-1.cr.volces.com/varmor/varmor --version 0.10.0
2. Install
helm install varmor varmor-0.10.0.tgz --namespace varmor --create-namespace --set image.registry="elkeid-ap-southeast-1.cr.volces.com"
3. Apply Policy
Create a VarmorPolicy to protect your workloads — supports AppArmor/BPF/Seccomp rules and NetworkProxy egress control
View Full GuideCommunity
Join the vArmor community
Open Source
vArmor was created by the Elkeid Team of the endpoint security department at ByteDance. The project is licensed under Apache 2.0 and is in active development.
Star on GitHubContribute
We welcome contributions from the community! Whether it's reporting bugs, improving documentation, or adding new features, your help is appreciated.
Contribution Guide