Interesting take. I’ve been looking a lot into hardening build clusters for our dev teams. We’re a k8s shop and use a mix of egress controls, host isolation, and Falco for detections (although we’ve had stability issues running the sidecar architecture).
- How do you capture context from the builds beyond vanilla ebpf traces? is there a way to see the detection ruleset/customize it
- I’m generally wary of running ebpf stuff on prod infra. Whats the threat model for your tool?
I'd love to give this a spin, but browsing through docs it seems like listen.dev works on Github hosted runners right now. Is self-hosted support on the roadmap?
- How do you capture context from the builds beyond vanilla ebpf traces? is there a way to see the detection ruleset/customize it
- I’m generally wary of running ebpf stuff on prod infra. Whats the threat model for your tool?
I'd love to give this a spin, but browsing through docs it seems like listen.dev works on Github hosted runners right now. Is self-hosted support on the roadmap?