vArmor

Summary

vArmor is a cloud-native container hardening system that leverages AppArmor/BPF/Seccomp and NetworkProxy technologies to enforce access control from system calls to application protocols — protecting workloads including AI Agents.

Release history

1. v0.10.4 Aug 13, 2026 · issue 011

   vArmor v0.10.4 adds egress audit-log persistence for Kata/micro-VMs, iptables backend auto-detection, and cluster-wide default sidecar resources via ConfigMap.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.10.4 https://github.com/bytedance/vArmor.git
   # already have the repo? check out this version:
   $ git checkout v0.10.4

   • ›Adds cluster-wide default sidecar resources via the varmor-config ConfigMap, with independent nonMitm/mitm resource tiers — hot-reloadable without restart.
   • ›Adds egress audit-log persistence for Kata/micro-VM runtimes (Kata, VCI, ECI) via an in-sidecar ALS sink, with micro-VM detection driven by the varmor-config ConfigMap.
   • ›Adds iptables backend auto-detection (legacy/nft) in proxy-init, aborting with CONFLICT instead of silently blackholing traffic when backends conflict.
   • ›Enhances policy-advisor to detect shell usage by file extension (e.g. .sh).
   └──▷ BREAKING ON UPGRADE

   • !Requires proxyinit:v0.2 or newer for iptables backend auto-adaptation; older proxy-init images will not support the new backend detection.