[{"_1":2,"_189":-5,"_190":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_164":165},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_84":85,"_109":110,"_157":-5,"_158":11,"_159":17,"_160":11,"_161":-5,"_162":163},"canonicalUrl","https://hub.docker.com/r/cilium/cilium-runtime-2/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","cilium","reponame","cilium-runtime-2","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":70,"_75":17,"_76":77,"_81":29,"_82":83},"categories",[],"content_types",[40],"image","date_registered","2018-03-29T15:53:43.368068Z","description","Repository for cilium-runtime-2","is_private","last_updated","2018-04-07T21:20:33.673754Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[52],"application/vnd.docker.container.image.v1+json","name","pull_count",3627,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","|logo|\n\n|build-status| |go-report| |go-doc| |rtd| |apache| |gpl| |slack|\n\nCilium is open source software for providing and transparently securing network\nconnectivity and loadbalancing between application workloads such as\napplication containers or processes. Cilium operates at Layer 3/4 to provide\ntraditional networking and security services as well as Layer 7 to protect and\nsecure use of modern application protocols such as HTTP, gRPC and Kafka. Cilium\nis integrated into common orchestration frameworks such as Kubernetes and Mesos.\n\nA new Linux kernel technology called BPF is at the foundation of Cilium. It\nsupports dynamic insertion of BPF bytecode into the Linux kernel at various\nintegration points such as: network IO, application sockets, and tracepoints to\nimplement security, networking and visibility logic. BPF is highly efficient\nand flexible. To learn more about BPF, read more in our extensive\n`BPF and XDP Reference Guide`_.\n\n.. image:: https://cdn.rawgit.com/cilium/cilium/master/Documentation/images/cilium-arch.png\n :align: center\n\nFunctionality Overview\n======================\n\n.. begin-functionality-overview\n\nProtect and secure APIs transparently\n-------------------------------------\n\nAbility to secure modern application protocols such as REST/HTTP, gRPC and\nKafka. Traditional firewalls operates at Layer 3 and 4. A protocol running on a\nparticular port is either completely trusted or blocked entirely. Cilium\nprovides the ability to filter on individual application protocol requests such\nas:\n\n- Allow all HTTP requests with method ``GET`` and path ``/public/.*``. Deny all\n other requests.\n- Allow ``service1`` to produce on Kafka topic ``topic1`` and ``service2`` to\n consume on ``topic1``. Reject all other Kafka messages.\n- Require the HTTP header ``X-Token: [0-9]+`` to be present in all REST calls.\n\nSee the section `Layer 7 Policy`_ in our documentation for the latest list of\nsupported protocols and examples on how to use it.\n\nSecure service to service communication based on identities\n-----------------------------------------------------------\n\nModern distributed applications rely on technologies such as application\ncontainers to facilitate agility in deployment and scale out on demand. This\nresults in a large number of application containers to be started in a short\nperiod of time. Typical container firewalls secure workloads by filtering on\nsource IP addresses and destination ports. This concept requires the firewalls\non all servers to be manipulated whenever a container is started anywhere in\nthe cluster.\n\nIn order to avoid this situation which limits scale, Cilium assigns a security\nidentity to groups of application containers which share identical security\npolices. The identity is then associated with all network packets emitted by\nthe application containers, allowing to validate the identity at the receiving\nnode. Security identity management is performed using a key-value store.\n\nSecure access to and from external services\n-------------------------------------------\n\nLabel based security is the tool of choice for cluster internal access control.\nIn order to secure access to and from external services, traditional CIDR based\nsecurity policies for both ingress and egress are supported. This allows to\nlimit access to and from application containers to particular IP ranges.\n\nSimple Networking\n-----------------\n\nA simple flat Layer 3 network with the ability to span multiple clusters\nconnects all application containers. IP allocation is kept simple by using host\nscope allocators. This means that each host can allocate IPs without any\ncoordination between hosts.\n\nThe following multi node networking models are supported:\n\n* **Overlay:** Encapsulation based virtual network spawning all hosts.\n Currently VXLAN and Geneve are baked in but all encapsulation formats\n supported by Linux can be enabled.\n\n When to use this mode: This mode has minimal infrastructure and integration\n requirements. It works on almost any network infrastructure as the only\n requirement is IP connectivity between hosts which is typically already\n given.\n\n* **Native Routing:** Use of the regular routing table of the Linux host.\n The network is required to be capable to route the IP addresses of the\n application containers.\n\n When to use this mode: This mode is for advanced users and requires some\n awareness of the underlying networking infrastructure. This mode works well\n with:\n\n - Native IPv6 networks\n - In conjunction with cloud network routers\n - If you are already running routing daemons\n\nLoad balancing\n--------------\n\nDistributed load balancing for traffic between application containers and to\nexternal services. The loadbalancing is implemented using BPF using efficient\nhashtables allowing for almost unlimited scale and supports direct server\nreturn (DSR) if the loadbalancing operation is not performed on the source\nhost.\n\nMonitoring and Troubleshooting\n------------------------------\n\nThe ability to gain visibility and to troubleshoot issues is fundamental to the\noperation of any distributed system. While we learned to love tools like\n``tcpdump`` and ``ping`` and while they will always find a special place in our\nhearts, we strive to provide better tooling for troubleshooting. This includes\ntooling to provide:\n\n- Event monitoring with metadata: When a packet is dropped, the tool doesn't\n just report the source and destination IP of the packet, the tool provides\n the full label information of both the sender and receiving among a lot of\n other information.\n\n- Policy decision tracing: Why is a packet being dropped or a request rejected.\n The policy tracing framework allows to trace the policy decision process for\n both, running workloads and based on arbitrary label definitions.\n\n- Metrics export via Prometheus: Key metrics are exported via Prometheus for\n integration with your existing dashboards.\n\nIntegrations\n------------\n\n* Network plugin integrations: CNI_, libnetwork_\n* Container runtime events: containerd_\n* Kubernetes: NetworkPolicy_, Labels_, Ingress_, Service_\n* Logging: syslog, fluentd_\n\n.. _CNI: https://github.com/containernetworking/cni\n.. _libnetwork: https://github.com/docker/libnetwork\n.. _containerd: https://github.com/containerd/containerd\n.. _service: https://kubernetes.io/docs/concepts/services-networking/service/\n.. _Ingress: https://kubernetes.io/docs/concepts/services-networking/ingress/\n.. _NetworkPolicy: https://kubernetes.io/docs/concepts/services-networking/network-policies/\n.. _Labels: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/\n.. _fluentd: http://www.fluentd.org/\n.. _`Layer 7 Policy`: http://docs.cilium.io/en/latest/policy/#layer-7\n\n.. end-functionality-overview\n\nGetting Started\n===============\n\n* `Why Cilium?`_\n* `Getting Started`_\n* `Architecture and Concepts`_\n* `Installing Cilium`_\n* `Frequently Asked Questions`_\n* Contributing_\n\nWhat is eBPF and XDP?\n=====================\n\nBerkeley Packet Filter (BPF) is a Linux kernel bytecode interpreter originally\nintroduced to filter network packets, e.g. for tcpdump and socket filters. The\nBPF instruction set and surrounding architecture has recently been\nsignificantly reworked with additional data structures such as hash tables and\narrays for keeping state as well as additional actions to support packet\nmangling, forwarding, encapsulation, etc. Furthermore, a compiler back end for\nLLVM allows for programs to be written in C and compiled into BPF instructions.\nAn in-kernel verifier ensures that BPF programs are safe to run and a JIT\ncompiler converts the BPF bytecode to CPU architecture specific instructions\nfor native execution efficiency. BPF programs can be run at various hooking\npoints in the kernel such as for incoming packets, outgoing packets, system\ncalls, kprobes, uprobes, tracepoints, etc.\n\nBPF continues to evolve and gain additional capabilities with each new Linux\nrelease. Cilium leverages BPF to perform core data path filtering, mangling,\nmonitoring and redirection, and requires BPF capabilities that are in any Linux\nkernel version 4.8.0 or newer (the latest current stable Linux kernel is\n4.14.x).\n\nMany Linux distributions including CoreOS, Debian, Docker's LinuxKit, Fedora,\nand Ubuntu already ship kernel versions >= 4.8.x. You can check your Linux\nkernel version by running ``uname -a``. If you are not yet running a recent\nenough kernel, check the Documentation of your Linux distribution on how to run\nLinux kernel 4.9.x or later.\n\nTo read up on the necessary kernel versions to run the BPF runtime, see the\nsection Prerequisites_.\n\n.. image:: https://cdn.rawgit.com/cilium/cilium/master/Documentation/images/bpf-overview.png\n :align: center\n\nXDP is a further step in evolution and enables to run a specific flavor of BPF\nprograms from the network driver with direct access to the packet's DMA buffer.\nThis is, by definition, the earliest possible point in the software stack,\nwhere programs can be attached to in order to allow for a programmable, high\nperformance packet processor in the Linux kernel networking data path.\n\nFurther information about BPF and XDP targeted for developers can be found in\nthe `BPF and XDP Reference Guide`_.\n\nFurther Reading\n===============\n\n.. further-reading-begin\n\nRelated Material\n----------------\n\n* `k8s-snowflake: Configs and scripts for bootstrapping an opinionated\n Kubernetes cluster anywhere using Cilium plugin\n `_\n* `Using Cilium for NetworkPolicy: Kubernetes documentation on how to use Cilium\n to implement NetworkPolicy\n `_\n\nPresentations\n-------------\n\n* DockerCon, Austin TX, Apr 2017 - Cilium - Network and Application Security with BPF and XDP: `Slides\n `__, `Video `__\n* CNCF/KubeCon Meetup, Berlin, Mar 2017 - Linux Native, HTTP Aware Network Security:\n `Slides `__, `Video `__\n* Docker Distributed Systems Summit, Berlin, Oct 2016:\n `Slides `__, `Video `__\n* NetDev1.2, Tokyo, Sep 2016 - cls_bpf/eBPF updates since netdev 1.1: `Slides `__, `Video `__\n* NetDev1.2, Tokyo, Sep 2016 - Advanced programmability and recent updates with tc’s cls_bpf: `Slides `__, `Video `__\n* ContainerCon NA, Toronto, Aug 2016 - Fast IPv6 container networking with BPF & XDP: `Slides `__\n\nPodcasts\n--------\n\n* Software Gone Wild by Ivan Pepelnjak, Oct 2016: `Blog `__, `MP3 `__\n* OVS Orbit by Ben Pfaff, May 2016: `Blog `__, `MP3 `__\n\nCommunity blog posts\n--------------------\n\n* `Cilium for Network and Application Security with BPF and XDP, Apr 2017\n `_\n* `Cilium, BPF and XDP, Google Open Source Blog, Nov 2016\n `_\n\n.. further-reading-end\n\nWeekly Hangout\n==============\n* The developer community is hanging out on zoom on a weekly basis to chat.\n Everybody is welcome.\n* Weekly, Monday, 9:00 am PT, 12:00 pm (noon) ET, 6:00 pm CEST\n* `Join zoom `_\n\nContact\n=======\n\nIf you have any questions feel free to contact us on `Slack `_.\n\nLicense\n=======\n\nThe cilium user space components are licensed under the\n`Apache License, Version 2.0 `_. The BPF code templates are licensed\nunder the `General Public License, Version 2.0 `_.\n\n.. _`Why Cilium?`: http://docs.cilium.io/en/latest/intro/#why-cilium\n.. _`Getting Started`: http://docs.cilium.io/en/latest/gettingstarted/\n.. _`Architecture and Concepts`: http://docs.cilium.io/en/latest/concepts/\n.. _`Installing Cilium`: http://docs.cilium.io/en/latest/install/guides/\n.. _`Frequently Asked Questions`: https://github.com/cilium/cilium/issues?utf8=%E2%9C%93&q=is%3Aissue+label%3Akind%2Fquestion+\n.. _Contributing: http://docs.cilium.io/en/latest/contributing\n.. _Prerequisites: http://docs.cilium.io/en/stable/install/#system-requirements\n.. _`BPF and XDP Reference Guide`: http://docs.cilium.io/en/latest/bpf/\n\n.. |logo| image:: https://cdn.rawgit.com/cilium/cilium/master/Documentation/images/logo.svg\n :alt: Cilium Logo\n :width: 350px\n\n.. |build-status| image:: https://jenkins.cilium.io/job/cilium-ginkgo/job/cilium/job/master/badge/icon\n :alt: Build Status\n :scale: 100%\n :target: https://jenkins.cilium.io/job/cilium-ginkgo/job/cilium/job/master/\n\n.. |go-report| image:: https://goreportcard.com/badge/github.com/cilium/cilium\n :alt: Go Report Card\n :target: https://goreportcard.com/report/github.com/cilium/cilium\n\n.. |go-doc| image:: https://godoc.org/github.com/cilium/cilium?status.svg\n :alt: GoDoc\n :target: https://godoc.org/github.com/cilium/cilium\n\n.. |rtd| image:: https://readthedocs.org/projects/docs/badge/?version=latest\n :alt: Read the Docs\n :target: http://cilium.readthedocs.io/en/latest/\n\n.. |apache| image:: https://img.shields.io/badge/license-Apache-blue.svg\n :alt: Apache licensed\n :target: https://github.com/cilium/cilium/blob/master/LICENSE\n\n.. |gpl| image:: https://img.shields.io/badge/license-GPL-blue.svg\n :alt: GPL licensed\n :target: https://github.com/cilium/cilium/blob/master/bpf/COPYING\n\n.. |slack| image:: https://cilium.herokuapp.com/badge.svg\n :alt: Join the Cilium slack channel\n :target: https://cilium.herokuapp.com/\n","has_starred","hub_user","immutable_tags_settings",{"_71":11,"_72":73},"enabled","rules",[74],".*","is_automated","permissions",{"_78":17,"_79":11,"_80":11},"read","write","admin","user","storage_size",238215586,"orgData",{"_86":87,"_88":89,"_90":91,"_92":29,"_93":94,"_95":96,"_97":98,"_99":100,"_101":102,"_103":104,"_105":96,"_106":107,"_108":17},"id","3b7f8b7c57514e92b2057f3900725c47","uuid","3b7f8b7c-5751-4e92-b205-7f3900725c47","type","organization","orgname","full_name","Cilium","location","","company","Isovalent.com","profile_url","https://cilium.io","date_joined","2015-08-20T08:40:26.980917Z","gravatar_url","https://www.gravatar.com/avatar/814b52d5a784ef59084cab53f6ab5ba4?s=80&r=g&d=mm","gravatar_email","badge","open_source","is_active","recentTags",[111,147],{"_112":40,"_113":114,"_115":116,"_86":117,"_118":119,"_46":136,"_137":114,"_138":29,"_139":52,"_53":140,"_141":142,"_143":127,"_144":136,"_145":62,"_146":17},"content_type","creator",409729,"full_size",139287763,25235262,"images",[120],{"_121":122,"_123":124,"_125":96,"_126":127,"_128":129,"_130":131,"_132":96,"_133":-5,"_134":116,"_59":62,"_135":-5},"architecture","amd64","digest","sha256:4cc6644afbaa50506ee4f50bd7039e48dc6d70cfa3a5d7a220a878f3d12199e0","features","last_pulled","2026-09-16T01:02:07.703917923Z","last_pushed","2018-04-07T21:20:34Z","os","linux","os_features","os_version","size","variant","2018-04-07T21:20:33.241985Z","last_updater","last_updater_username","media_type","2018-04-07","repository",5112962,"tag_last_pulled","tag_last_pushed","tag_status","v2",{"_112":40,"_113":114,"_115":148,"_86":149,"_118":150,"_46":155,"_137":114,"_138":29,"_139":52,"_53":156,"_141":142,"_143":153,"_144":155,"_145":62,"_146":17},139251491,24819753,[151],{"_121":122,"_123":152,"_125":96,"_126":153,"_128":154,"_130":131,"_132":96,"_133":-5,"_134":148,"_59":62,"_135":-5},"sha256:2922ed54bab7b4a706ce58d95886c27bcef757ae8f7b6712835fdb92ad600830","2026-09-14T16:03:25.242024108Z","2018-03-30T17:56:41Z","2018-03-30T17:56:40.518684Z","2018-03-29","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":166,"_173":174,"_162":187,"_188":11},{"_36":167,"_38":168,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":169,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":170,"_75":17,"_76":172,"_81":29,"_82":83},[],[40],[52],{"_71":11,"_72":171},[74],{"_78":17,"_79":11,"_80":11},"tags",{"_175":176,"_177":-5,"_178":-5,"_179":180},"count",2,"next","previous","results",[181,184],{"_112":40,"_113":114,"_115":116,"_86":117,"_118":182,"_46":136,"_137":114,"_138":29,"_139":52,"_53":140,"_141":142,"_143":127,"_144":136,"_145":62,"_146":17},[183],{"_121":122,"_123":124,"_125":96,"_126":127,"_128":129,"_130":131,"_132":96,"_133":-5,"_134":116,"_59":62,"_135":-5},{"_112":40,"_113":114,"_115":148,"_86":149,"_118":185,"_46":155,"_137":114,"_138":29,"_139":52,"_53":156,"_141":142,"_143":153,"_144":155,"_145":62,"_146":17},[186],{"_121":122,"_123":152,"_125":96,"_126":153,"_128":154,"_130":131,"_132":96,"_133":-5,"_134":148,"_59":62,"_135":-5},[],"canDeleteTags","actionData","errors"]

cilium/cilium-runtime-2

Tags for cilium/cilium-runtime-2