Endpoint Security for Linux Runtime Configurations

Overview

The CPLA component monitors applications running inside Linux containers and associates security events with the correct container context.

By retrieving metadata from the container runtime, CPLA improves event accuracy and supports investigation of container-based activity.

Limitations

• Default configuration works for most environments.

• The CRI-O socket path cannot be modified.

• Kubernetes distributions may require runtime-specific configuration.

How Container Runtime Monitoring Works

When container runtime monitoring is enabled:

1. An application running inside a container generates a security event.

2. CPLA identifies the container associated with the event.

3. CPLA queries the container runtime API.

4. The container runtime returns container metadata.

5. CPLA enriches the event with container context information.

Supported Container Runtimes

CPLA supports the following container runtimes:

• Docker

• containerd

• CRI-O

Default configuration settings are provided for all supported runtimes and are suitable for most environments. In certain deployments, configuration customization may be required to align with the infrastructure or runtime setup.

Prerequisites

Before configuring container runtime integration, verify that:

• The CPLA service is installed and running

• A supported container runtime (Docker, containerd, or CRI-O) is installed.

Configuring Container Runtime Settings

CPLA container runtime settings are configured using environment variables in the CPLA environment file.

1. Stop the CPLA service.

   systemctl stop cpla.service

2. Edit the file.

   /etc/checkpoint/cpla/env

   Add or modify the required environment variables. (See, Runtime-Specific Configuration).

3. Start the CPLA service.

   systemctl start cpla.service

Path Configuration Requirements

CPLA runs in a sandbox and accesses the host filesystem through a /host mount.

• If a configured path is outside /run or /var/run, the path must be prefixed with /host

• Paths under /run or /var/run do not require the /host prefix

For example: