mxcrafts/ltrack repository overview

⁠ltrack - Security Observability Framework for ML/AI Model File Loading

ltrack is an open-source security observability tool that monitors and analyzes potential risks during the loading and execution of machine learning (ML) and artificial intelligence (AI) model files. Developed with Golang and eBPF (Extended Berkeley Packet Filter), ltrack ensures high-performance, low-overhead monitoring for real-time detection of vulnerabilities, unauthorized access, and anomalous activities in ML/AI workflows.

This Docker image allows seamless deployment of ltrack for security observability in MLOps pipelines, research environments, and compliance monitoring. With a lightweight footprint, it does not require external kernel modules or agents, reducing attack surfaces and simplifying operations.

⁠Key Features:

• eBPF-Powered Efficiency: Low-overhead event tracing with real-time monitoring of file operations, process executions, and network activities.
• File Monitoring: Monitor file operations (create, delete, modify) in specified directories.
• Process Monitoring: Track execution of specific commands (e.g., bash, python).
• Network Monitoring: Monitor network activity on specific ports and protocols (TCP, UDP).
• Real-Time Alerts: Integrates with logging systems like Elasticsearch and Prometheus for proactive threat response.
• Zero-Dependency: No reliance on external kernel modules or agents.
• Extensible Architecture: Easily add custom plugins for enhanced monitoring and integration.
• High Performance: Designed to minimize system overhead and run efficiently on Linux environments.

⁠Quick Start:

You can easily get started with ltrack using Docker by running the following command:

docker run -d   --name ltrack   --privileged   --pid host   --network host   -v /sys/kernel/debug:/sys/kernel/debug:ro   -v /sys/fs/bpf:/sys/fs/bpf   -v /proc:/proc   -v /lib/modules:/lib/modules:ro   -v ltrack_logs:/var/log/ltrack   -v <path>/policy.toml:/app/external-config/policy.toml:ro   -e LTRACK_LOG_LEVEL=info   -e LTRACK_LOG_FORMAT=json   mxcrafts/ltrack:latest

This runs ltrack with privileged access, enabling it to monitor file, process, and network activity in real-time.

⁠Build Locally:

To build the image locally, clone the repository and use Docker Compose:

cd deploy
docker-compose up -d

⁠Use Cases:

• MLOps Pipelines: Enhance security in CI/CD workflows by auditing model deployment processes.
• Research Environments: Safeguard experimental models and datasets from unauthorized access or tampering.
• Compliance: Ensure regulatory requirements like GDPR, HIPAA are met through strict access controls and audit trails.

⁠Performance:

ltrack is designed for minimal system impact, with eBPF providing efficient, low-overhead event tracking:

⁠License:

This project is licensed under the MIT License⁠.