KubeArmor

Overview

KubeArmor is a free, self-hosted runtime security project for Linux workloads, with policy controls for Kubernetes and other supported environments. It suits teams that can operate their own security tooling and need rules tied to workload identity. Its appeal is broad runtime control without a paid plan; the practical trade-offs are environment-specific support and audit-only system-call monitoring.

Key features

KubeArmor uses Linux Security Modules, including AppArmor, SELinux, and BPF-LSM, to apply policies while workloads run. Container policies can allow, audit, or block activity, with blocking the default. Rules can target process and file paths or directories, network protocols, capabilities, and system calls. This breadth is useful for teams defining controls around what workloads may do, but system-call rules only provide audit visibility rather than prevention.

For Kubernetes, policy authors can use metadata and select pods by labels or label expressions. That makes it possible to associate controls with workload identities instead of treating each container as an unrelated target. eBPF-based telemetry records policy violations and tracks container processes, carrying container, pod, and namespace identities to help connect events to their source.

The deployment matrix spans Kubernetes, non-Kubernetes containers, virtual machines, and bare-metal hosts, though supported enforcement varies with environment, operating system, and architecture. Some environments are observability-only, including RHEL or CentOS 8.4 and earlier on Kubernetes and Oracle Ampere; VMware Tanzu support is under construction. The project also provides hardening guidance based on MITRE, STIG, and CIS, plus integrations for OpenTelemetry, Prometheus, Kafka, Grafana, ELK dashboards, GitHub Actions, and a Rancher UI extension.

KubeArmor is community-governed and a CNCF Sandbox project. Project support is available through the maintainer group by email, CNCF Slack, GitHub Discussions, and GitHub Issues. Security vulnerabilities should be reported through the project's security process rather than as public GitHub issues.

Pricing

KubeArmor is open source and free: its KubeArmor plan costs nothing. There are no cheaper tiers with reduced features to weigh against a paid option; users take on the work of operating a self-hosted project, and workload and platform support depends on the support matrix. This fits teams that want runtime protection and Kubernetes security without a software license charge. Admission control is not included.

Platforms

KubeArmor is listed for API, Linux, and self-hosted use. The project documents Kubernetes environments including GKE, AKS, OKE, IKS, EKS, OpenShift, Rancher, DigitalOcean Kubernetes, and Alibaba Cloud, among others. Installation guidance uses Helm and kubectl to deploy the operator on a Kubernetes cluster. Since support depends on operating system, architecture, and enforcement mode, teams should match their specific environment to the matrix before choosing it for prevention rather than observability.

Who it's for

KubeArmor is a sensible fit for platform and security teams that operate Linux infrastructure and want workload-level runtime policies across Kubernetes, containers, virtual machines, or bare-metal hosts. Its stated use cases also include cloud containers, IoT and edge workloads, and 5G networks. It is less suitable for teams seeking a managed service, admission control, or blocking of system calls.

Pros and cons

• Pro: Workload-aware Kubernetes policies can select pods by labels and metadata, helping teams align controls with deployment identities.
• Pro: Runtime rules cover processes, files, networking, and capabilities, with blocking available for container policies.
• Pro: Free, open-source availability and deployment options beyond Kubernetes suit teams operating varied Linux workloads.
• Con: System-call monitoring is audit-only, so it cannot stop the calls it observes.
• Con: Enforcement support varies by environment, and some documented combinations are observation-only or unfinished.
• Con: Self-hosted deployment means the team must operate the project rather than rely on a managed service.
• Con: Admission control is not part of the offering.

Alternatives

Calico Cloud is worth considering if you want a freemium option with a web interface and a free tier capped at one user and one cluster, 24-hour log retention, and a view-only Policy Editor. Amazon GuardDuty is a paid, pay-as-you-go alternative with a free trial; charges depend on analyzed data and AWS Region, so it may suit teams preferring usage-based billing. Falco is another free, open-source Linux and self-hosted option to compare for runtime security.

Qualys TotalCloud offers a free license with limited API calls for control evaluation and a paid cloud-platform subscription, making it an alternative for teams evaluating that subscription model. Tetragon is a free open-source option for Kubernetes, Linux, and container installations. Tracee is a free Linux-only project that requires a compatible kernel and elevated capabilities.

Bitdefender Total Security is a paid alternative for Android, iOS, macOS, and Windows devices rather than self-hosted Linux workloads. Sysdig Secure is another option, with licensing based on the number of hosts in a customer's environment.

Browse more options in Cloud Workload Protection Platforms, Kubernetes Security Software, and Container Security Software.

Verdict

Choose KubeArmor if your team can run self-hosted Linux security tooling and wants free, workload-aware controls across supported deployment types. Its strongest reason to choose is the combination of Kubernetes identity-based policy and runtime enforcement across several kinds of workload. Look elsewhere if you need admission control, system-call blocking, managed operations, or consistent enforcement across an environment the support matrix limits.