Reality Kernel
Kernel-level enforcement for AI agents on Linux
Network, exec and file policy decided in the kernel, before the action, with a
signed record of every decision.
Install · Policy · Architecture · Threat model · Evidence · Website
AI agents run shell commands, read files and open network connections with
real privileges. Guardrails that inspect prompts or tool calls sit in front of
the agent; a prompt injection, a bug or a child process can step around them.
Reality Kernel puts the decision where it cannot be stepped around: in eBPF
programs attached to the Linux kernel's BPF-LSM and cgroup socket hooks, for
every process in a governed cgroup.
What it does
Every statement below links to the criterion whose tests prove it, on every
supported kernel, in every CI run (how this is checked).
- Denies governed network connections in the kernel with
EPERM, over TCP and UDP, IPv4 and IPv6. evidence
- Closes the usual bypasses: raw and packet sockets, TUN/TAP devices, io_uring, TCP Fast Open and NAT64 addresses. evidence · evidence
- Allows only listed executables, decided on file identity rather than path, so symlinks, replaced binaries, scripts and memfd tricks do not get around it. evidence · evidence
- Protects files per access type (read, write, delete, rename, link, create, setattr), whatever name the file is reached by. evidence · evidence
- Governs an agent launched with
rk run from its first instruction, and every process it starts. evidence · evidence
- Governs Kubernetes pods selected by annotation, through an NRI plugin, from their first instruction. evidence
- Applies policy changes atomically and rolls them back with one command. evidence · evidence
- Offers an audit mode that reports what would be denied without blocking it. evidence
- Keeps enforcing when the sensor restarts or crashes, and fails closed if it stays down. evidence ·
How it works
A governed workload makes a system call. An eBPF program attached to the
kernel decides it against the compiled policy, before the action happens, and
the decision streams to the audit log. The verdict never waits for userspace.
flowchart LR
subgraph user["User space"]
agent["Agent process<br/>and its children"]
sensor["rk-sensor"]
end
subgraph kernel["Linux kernel"]
hooks["BPF-LSM and<br/>cgroup sock_addr hooks"]
maps[("Policy maps")]
ring[["Ring buffer"]]
end
agent -- "connect · execve · openat · unlink · ..." --> hooks
maps --> hooks
hooks -- "allow, or -1 EPERM" --> agent
hooks --> ring --> sensor
sensor --> audit["Signed OCSF audit log"]
sensor --> metrics["Prometheus metrics"]
sensor --> traces["OpenTelemetry traces"]
A workload becomes governed when it is placed in a cgroup bound to a profile:
flowchart LR
policy["policy.toml"] -- "validate, compile,<br/>swap atomically" --> maps[("Policy maps")]
run["rk run --profile P"] --> agentd["rk-agentd"]
nri["Kubernetes pod<br/>(annotation)"] --> plugin["rk-nri plugin"] --> agentd
agentd -- "cgroup created and bound<br/>before the first instruction" --> cgroup["rk.slice/<agent>"]
cgroup -. "looked up per syscall" .-> maps
This is the beginning of the README. Read the rest at the original. Read the full README ↗
