# Nirmata Runtime for Kyverno adds eBPF-based runtime security

> **Key takeaway:** Nirmata Runtime extends Kyverno's policy enforcement from Kubernetes admission control to kernel-level runtime security using eBPF and LSM.

**Published:** 2026-10-15T11:00:00+00:00 
**Source:** Cloud Native Computing Foundation (CNCF) 
**Category:** cloud-native 
**Canonical URL:** https://fosswire.org/news/nirmata-runtime-for-kyverno-adds-ebpf-based-runtime-security.html 

## Summary
Nirmata has introduced Nirmata Runtime for Kyverno, an open source tool designed to bridge the security gap between deployment and execution. By utilizing eBPF and Linux Security Modules (LSM), it moves policy enforcement from the Kubernetes API level down to the kernel. This allows for synchronous, in-kernel blocking of unauthorized process executions, file access, and network connections, specifically targeting the unpredictable behaviors of autonomous AI workloads.

## Kernel-level enforcement for AI workloads
- Uses **eBPF** and **BPF-LSM** to attach programs to `bprm_check_security` and `file_open` syscalls.
- Implements **cgroup-scoped eBPF** programs for egress network path control.
- Supports five specific behaviors: **exec** (process execution), **open** (file access), **network** (egress destination), **protocol** (application-layer protocol validation), and **dns** (observation only).
- Utilizes **Common Expression Language (CEL)** to maintain policy syntax consistency with existing Kyverno admission policies.
- Features a **monitor mode** by default to allow testing via a `WouldDeny` signal before active enforcement.

## Why it matters
The tool allows operators to use a single policy language (CEL) to manage both deployment-time admission and runtime execution security, which is critical for securing non-deterministic AI agents.