Documentation
Everything lives in the repository
The documentation is versioned with the code, so it always describes the release you run. Start with the install guide, then the policy reference.
Get started
Install, upgrade, removePackages, systemd, Kubernetes with Helm, and
rk doctor.
Policy referenceProfiles, network, exec and file rules, bindings, and rolling out in audit mode.
Supported kernelsWhat each kernel version supports, and how CI tests it.
HardeningHost settings that matter for enforcement.
Operate
Audit logThe OCSF record format,
rk audit tail and rk audit verify.
ReleasesVersioning, the support window, and how to verify signatures, provenance and SBOMs.
ChangelogWhat changed in each release.
Understand
ArchitectureComponents, data flow and the lifecycle of the kernel programs.
Threat modelWhat it protects against, from whom, and where protection ends.
Architecture decisionsThe ADRs: why it is built the way it is.
Kernel ABIThe layouts shared between the BPF programs and userspace.
Verify
EvidenceEvery acceptance criterion and the named tests that prove it.
Testing strategyThe test layers, the kernel matrix, and what runs when.
Design notesOne per phase, with its acceptance criteria.