A kprobe on tcp_connect killed an npm postinstall's curl inside AWS CodeBuild

Tetragon's policy here is a single kprobe on `tcp_connect`, declared with `syscall: false`, reading argument index 0 as a `sock` ^[14]. Two conditions have to hold together before anything dies: the destination address is not inside 127.0.0.0/8, and the calling binary is /usr/bin/curl ^[14]. The matched action is `Sigkill` ^[14].

Coverage stops at that second condition. Because the policy identifies the offender by executable path, the same postinstall opening a socket from node, or from a copy of curl written elsewhere on disk, never matches the selector ^[19]. Tetragon's premise is that you describe behaviour instead of enumerating known vulnerabilities ^[3], and the behaviour described here is one binary.

A Node.js process listening on port 18080 in the same CodeBuild runner stands in for the external destination, and it writes a record to a file when curl's dummy value arrives ^[6][7]. The kill rule fires only on destinations outside 127.0.0.0/8 ^[14]. So for enforce mode to kill anything, curl has to target a non-loopback address that still reaches that local listener ^[20]. The post does not state which address it requests ^[21].

There are three settings to change. BTF type information is what lets Tetragon load eBPF programs matched to the running kernel, so the run pins a Linux 6 host kernel where BTF is available ^[10]. That kernel is configured separately from the build image, through a CDK escape hatch onto the `CfnProject`: `addPropertyOverride('Environment.HostKernel', 'LINUX_KERNEL_6')` ^[12]. A `buildspec-override:true` label goes on `runs-on` so Tetragon can be started during PRE_BUILD ^[13], and privileged mode is enabled so the eBPF programs can be loaded and attached to the kernel ^[11].

Observe and enforce load the identical YAML and differ only in the flag passed to `tetra tracingpolicy add`, monitor against enforce, with each mode on its own runner ^[16]. Rollout is the cheap part. A team can therefore run monitor across real pipelines and count matches before arming the kill. Any /usr/bin/curl call to a non-loopback address matches this rule, a release step fetching an artifact included ^[22].

The write-up follows Liz Rice's session "Detecting Compromised CI with eBPF and Cilium Tetragon" at KubeCon + CloudNativeCon Japan 2026 in July 2026 ^[1].

For the enforce result to transfer, four things have to be true in your pipeline: curl sits at /usr/bin/curl, the host kernel exposes BTF, your account permits privileged CodeBuild projects, and no legitimate build step needs curl off loopback. In the published run, enforce terminated curl with SIGKILL and produced no receive record ^[17], while baseline and observe let the request reach the file ^[18]. The compromised dependency was one the author wrote for the test and never published to npm ^[4][5].