Container-Level Auditing in Container Orchestrators with eBPF

This paper examines the application of eBPF (extended Berkeley Packet Filter) for achieving more precise auditing at the container level in container orchestrators such as Kubernetes. We address the challenges associated with auditing container behavior and highlight the advantages of leveraging eBPF to monitor container activities at the kernel level. We propose an eBPF-based solution that enhances transparency with respect to operations performed within containers. Overall, this study suggests that the use of eBPF for container-level auditing can provide valuable insights into container behavior and improve the security of containerized applications.