WP-21: Cloud-Native Container Drift Forensics via Driverless eBPF Telemetry: Guarding OCI Runtime Pods

Executive Abstract

In modern cloud-native infrastructures, containers are intended to be immutable, ephemeral execution units. In reality, container runtime environments (Kubernetes, Docker, containerd, CRI-O) represent prime attack surfaces for container escapes, cryptocurrency miners, rootkit injections, and supply-chain drift. Traditional container monitoring tools rely either on intrusive in-container sidecars—which consume substantial CPU overhead and require container image modification—or unsafe out-of-tree kernel modules that threaten the stability of the entire Kubernetes node pool.

This white paper presents alaskakernel, a pure-Rust, cloud-native container observability and drift detection engine leveraging safe Extended Berkeley Packet Filter (eBPF) tracepoints. We explore how alaskakernel hooks kernel tracepoints in user space to detect unauthorized runtime binary executions, file system layer modifications, namespace escapes, and privilege escalations inside Open Container Initiative (OCI) runtime pods without crashing worker nodes or altering container base images.

1. The Immutability Principle vs. Runtime Drift

In a secure container pipeline, all software must be built into the container image at compile time. Runtime drift occurs whenever an active container deviates from its immutable image specification:


CONTAINER RUNTIME OBSERVABILITY ARCHITECTURE:
┌────────────────────────────────────────────────────────┐
│ Kubernetes / OCI Container Pod                         │
│  [ Immutable Application Layer ]                       │
│  [ Rogue Process Injected: /tmp/miner ] ──(Drift!)     │
└──────────────────────────┬─────────────────────────────┘
                           │ sys_enter_execve / vfs_write
┌──────────────────────────▼─────────────────────────────┐
│ Linux Kernel Space                                     │
│  [ eBPF Tracepoint Probes (Memory-Safe In-Kernel VM) ] │
└──────────────────────────┬─────────────────────────────┘
                           │ Perf Event Ring Buffer (Zero-Copy)
┌──────────────────────────▼─────────────────────────────┐
│ alaskakernel User-Space Daemon (100% Pure Rust)        │
│  • Instant OCI Container ID Resolution                 │
│  • Detection of Unsigned Binaries & Shell Spawns       │
│  • Direct Telemetry Stream to Alaska Command Matrix     │
└────────────────────────────────────────────────────────┘

2. High-Performance eBPF Probe Telemetry

By attaching to kernel tracepoints (sched_process_exec, sys_enter_write, sys_enter_mount), alaskakernel extracts execution events directly from the kernel ring buffer with zero context-switch overhead:

Zero-Copy Serialization: Rust memory mapping consumes ring buffer structures directly, sustaining over 150,000 events per second per core with under 1.2% CPU overhead.
Container Attribution: Ingests cgroup v2 paths and namespace IDs (mnt, pid, net) to immediately attribute actions to exact Kubernetes pods, namespaces, and OCI container IDs.

3. Automated Containment & Cross-Platform Orchestration

When container drift is detected:

1. alaskakernel generates a cryptographically signed security event.

2. The event is broadcast to the Alaska Command Tactical Matrix under (Tactic: Execution, Pillar: Detect).

3. If autonomous containment is enabled, alaskakernel freezes the affected cgroup (cgroup.freeze) or terminates the offending PID inside the container namespace, preventing lateral movement across the Kubernetes cluster.