[{"_1":2,"_168":-5,"_169":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_156":157},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)",{"_23":24,"_25":26,"_77":78,"_94":-7,"_95":-7,"_96":-7,"_97":-7,"_98":-5,"_99":-5,"_100":11,"_101":11,"_71":102,"_148":17,"_118":119,"_149":117,"_150":70,"_40":58,"_151":11,"_152":17,"_153":43,"_154":-5,"_155":11},"scanningType","none","tagData",{"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_62":63,"_64":30,"_65":66,"_67":68,"_69":70,"_71":72,"_73":59,"_74":63,"_75":54,"_76":17},"content_type","image","creator",3445817,"full_size",80754737,"id",136012532,"images",[37,56],{"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":43,"_51":-5,"_52":32,"_53":54,"_55":-5},"architecture","amd64","digest","sha256:73c317fbf55f21ac32e5b8225c8ca866fa988751053a49cab6695314ed971b9b","features","","last_pulled","2026-09-20T08:07:41.025814542Z","last_pushed","2021-02-03T18:49:31Z","os","linux","os_features","os_version","size","status","active","variant",{"_38":57,"_40":58,"_42":43,"_44":59,"_46":60,"_48":49,"_50":43,"_51":-5,"_52":61,"_53":54,"_55":-5},"arm64","sha256:967f16fed139bcd297370fb63fbc4b2cb10787f863f9c6267292cd78c76d1bd6","2026-09-20T08:07:41.071415494Z","2021-02-03T18:49:32Z",78470882,"last_updated","2021-02-03T18:49:31.564974Z","last_updater","last_updater_username","ciliumbot","media_type","application/vnd.docker.distribution.manifest.list.v2+json","name","2fb621b69366fad1300a7e9bf09d2acff01cadf2","repository",9261579,"tag_last_pulled","tag_last_pushed","tag_status","v2","tagImages",[79,89],{"_38":57,"_40":58,"_42":43,"_44":59,"_46":60,"_80":81,"_48":49,"_50":43,"_51":-5,"_52":61,"_53":54,"_55":-5},"layers",[82,86],{"_52":83,"_84":85,"_40":43},0,"instruction","LABEL maintainer=maintainer@cilium.io",{"_40":87,"_52":61,"_84":88},"sha256:2be1cc288ffa59fbdc896b8087e10aa18f8e71002008c2c390dd2e980044a1f2","COPY / / # buildkit",{"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_80":90,"_48":49,"_50":43,"_51":-5,"_52":32,"_53":54,"_55":-5},[91,92],{"_52":83,"_84":85,"_40":43},{"_40":93,"_52":32,"_84":88},"sha256:bf93a0d97bc148f1397b2ecee077a19ff28cf761c5fc3c367b0cc32e2d2310ec","layerOrdinals","packageName","cveId","sbom","scoutSummary","staticSummary","isScoutPaymentRequired","canSeeVulnerabilities",{"_103":104,"_105":106,"_107":108,"_109":43,"_110":11,"_62":111,"_112":113,"_114":115,"_69":117,"_118":119,"_120":121,"_122":28,"_123":83,"_53":124,"_125":126,"_127":-5,"_128":83,"_129":130,"_131":11,"_132":119,"_133":134,"_139":11,"_140":141,"_145":119,"_146":147},"categories",[],"content_types",[28],"date_registered","2020-06-15T14:22:48.255365Z","description","is_private","2022-07-15T15:37:44.085878Z","last_modified","2026-07-27T20:55:47.003475Z","media_types",[116,68],"application/vnd.docker.container.image.v1+json","cilium-runtime-dev","namespace","cilium","pull_count",19598,"repository_type","star_count",6,"status_description","archived","source","collaborator_count","full_description","|logo|\n\n|cii| |build-status| |pulls| |slack| |go-report| |go-doc| |rtd| |apache| |gpl|\n\nCilium is open source software for providing and transparently securing network\nconnectivity and loadbalancing between application workloads such as\napplication containers or processes. Cilium operates at Layer 3/4 to provide\ntraditional networking and security services as well as Layer 7 to protect and\nsecure use of modern application protocols such as HTTP, gRPC and Kafka. Cilium\nis integrated into common orchestration frameworks such as Kubernetes and Mesos.\n\nA new Linux kernel technology called eBPF_ is at the foundation of Cilium. It\nsupports dynamic insertion of eBPF bytecode into the Linux kernel at various\nintegration points such as: network IO, application sockets, and tracepoints to\nimplement security, networking and visibility logic. eBPF is highly efficient\nand flexible. To learn more about eBPF, visit `eBPF.io`_.\n\n.. image:: https://cdn.rawgit.com/cilium/cilium/master/Documentation/images/cilium_overview.png\n :align: center\n\nStable Releases\n===============\n\nThe Cilium community maintains minor stable releases for the last three major\nCilium versions. Older Cilium stable versions from major releases prior to that\nare considered EOL.\n\nFor upgrades to new major releases please consult the `Cilium Upgrade Guide\n`_.\n\nListed below are the actively maintained release branches along with their latest\nminor release, corresponding image pull tags and their release notes:\n\n+-------------------------------------------------------+------------+--------------------------------------+---------------------------------------------------------------------------+------------------------------------------------------------------------+\n| `v1.8 `__ | 2020-09-30 | ``docker.io/cilium/cilium:v1.8.4`` | `Release Notes `__ | `General Announcement `__ |\n+-------------------------------------------------------+------------+--------------------------------------+---------------------------------------------------------------------------+------------------------------------------------------------------------+\n| `v1.7 `__ | 2020-09-30 | ``docker.io/cilium/cilium:v1.7.10`` | `Release Notes `__ | `General Announcement `__ |\n+-------------------------------------------------------+------------+--------------------------------------+---------------------------------------------------------------------------+------------------------------------------------------------------------+\n| `v1.6 `__ | 2020-09-30 | ``docker.io/cilium/cilium:v1.6.12`` | `Release Notes `__ | `General Announcement `__ |\n+-------------------------------------------------------+------------+--------------------------------------+---------------------------------------------------------------------------+------------------------------------------------------------------------+\n\nFunctionality Overview\n======================\n\n.. begin-functionality-overview\n\nProtect and secure APIs transparently\n-------------------------------------\n\nAbility to secure modern application protocols such as REST/HTTP, gRPC and\nKafka. Traditional firewalls operates at Layer 3 and 4. A protocol running on a\nparticular port is either completely trusted or blocked entirely. Cilium\nprovides the ability to filter on individual application protocol requests such\nas:\n\n- Allow all HTTP requests with method ``GET`` and path ``/public/.*``. Deny all\n other requests.\n- Allow ``service1`` to produce on Kafka topic ``topic1`` and ``service2`` to\n consume on ``topic1``. Reject all other Kafka messages.\n- Require the HTTP header ``X-Token: [0-9]+`` to be present in all REST calls.\n\nSee the section `Layer 7 Policy`_ in our documentation for the latest list of\nsupported protocols and examples on how to use it.\n\nSecure service to service communication based on identities\n-----------------------------------------------------------\n\nModern distributed applications rely on technologies such as application\ncontainers to facilitate agility in deployment and scale out on demand. This\nresults in a large number of application containers to be started in a short\nperiod of time. Typical container firewalls secure workloads by filtering on\nsource IP addresses and destination ports. This concept requires the firewalls\non all servers to be manipulated whenever a container is started anywhere in\nthe cluster.\n\nIn order to avoid this situation which limits scale, Cilium assigns a security\nidentity to groups of application containers which share identical security\npolicies. The identity is then associated with all network packets emitted by\nthe application containers, allowing to validate the identity at the receiving\nnode. Security identity management is performed using a key-value store.\n\nSecure access to and from external services\n-------------------------------------------\n\nLabel based security is the tool of choice for cluster internal access control.\nIn order to secure access to and from external services, traditional CIDR based\nsecurity policies for both ingress and egress are supported. This allows to\nlimit access to and from application containers to particular IP ranges.\n\nSimple Networking\n-----------------\n\nA simple flat Layer 3 network with the ability to span multiple clusters\nconnects all application containers. IP allocation is kept simple by using host\nscope allocators. This means that each host can allocate IPs without any\ncoordination between hosts.\n\nThe following multi node networking models are supported:\n\n* **Overlay:** Encapsulation-based virtual network spanning all hosts.\n Currently VXLAN and Geneve are baked in but all encapsulation formats\n supported by Linux can be enabled.\n\n When to use this mode: This mode has minimal infrastructure and integration\n requirements. It works on almost any network infrastructure as the only\n requirement is IP connectivity between hosts which is typically already\n given.\n\n* **Native Routing:** Use of the regular routing table of the Linux host.\n The network is required to be capable to route the IP addresses of the\n application containers.\n\n When to use this mode: This mode is for advanced users and requires some\n awareness of the underlying networking infrastructure. This mode works well\n with:\n\n - Native IPv6 networks\n - In conjunction with cloud network routers\n - If you are already running routing daemons\n\nLoad Balancing\n--------------\n\nCilium implements distributed load balancing for traffic between application\ncontainers and to external services and is able to fully replace components\nsuch as kube-proxy. The load balancing is implemented in eBPF using efficient\nhashtables allowing for almost unlimited scale.\n\nFor north-south type load balancing, Cilium's eBPF implementation is optimized\nfor maximum performance, can be attached to XDP (eXpress Data Path), and supports\ndirect server return (DSR) as well as Maglev consistent hashing if the load\nbalancing operation is not performed on the source host.\n\nFor east-west type load balancing, Cilium performs efficient service-to-backend\ntranslation right in the Linux kernel's socket layer (e.g. at TCP connect time)\nsuch that per-packet NAT operations overhead can be avoided in lower layers.\n\nBandwidth Management\n--------------------\n\nCilium implements bandwidth management through efficient EDT-based (Earliest Departure\nTime) rate-limiting with eBPF for container traffic that is egressing a node. This\nallows to significantly reduce transmission tail latencies for applications and to\navoid locking under multi-queue NICs compared to traditional approaches such as HTB\n(Hierarchy Token Bucket) or TBF (Token Bucket Filter) as used in the bandwidth CNI\nplugin, for example.\n\nMonitoring and Troubleshooting\n------------------------------\n\nThe ability to gain visibility and to troubleshoot issues is fundamental to the\noperation of any distributed system. While we learned to love tools like\n``tcpdump`` and ``ping`` and while they will always find a special place in our\nhearts, we strive to provide better tooling for troubleshooting. This includes\ntooling to provide:\n\n- Event monitoring with metadata: When a packet is dropped, the tool doesn't\n just report the source and destination IP of the packet, the tool provides\n the full label information of both the sender and receiver among a lot of\n other information.\n\n- Policy decision tracing: Why is a packet being dropped or a request rejected.\n The policy tracing framework allows to trace the policy decision process for\n both, running workloads and based on arbitrary label definitions.\n\n- Metrics export via Prometheus: Key metrics are exported via Prometheus for\n integration with your existing dashboards.\n\n- Hubble_: An observability platform specifically written for Cilium. It\n provides service dependency maps, operational monitoring and alerting,\n and application and security visibility based on flow logs.\n\n.. _Hubble: https://github.com/cilium/hubble/\n\nIntegrations\n------------\n\n* Network plugin integrations: CNI_, libnetwork_\n* Container runtime events: containerd_\n* Kubernetes: NetworkPolicy_, Labels_, Ingress_, Service_\n\n.. _CNI: https://github.com/containernetworking/cni\n.. _libnetwork: https://github.com/docker/libnetwork\n.. _containerd: https://github.com/containerd/containerd\n.. _service: https://kubernetes.io/docs/concepts/services-networking/service/\n.. _Ingress: https://kubernetes.io/docs/concepts/services-networking/ingress/\n.. _NetworkPolicy: https://kubernetes.io/docs/concepts/services-networking/network-policies/\n.. _Labels: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/\n.. _`Layer 7 Policy`: http://docs.cilium.io/en/stable/policy/#layer-7\n\n.. end-functionality-overview\n\nGetting Started\n===============\n\n* `Why Cilium?`_\n* `Getting Started`_\n* `Architecture and Concepts`_\n* `Installing Cilium`_\n* `Frequently Asked Questions`_\n* Contributing_\n\nWhat is eBPF and XDP?\n=====================\n\nBerkeley Packet Filter (BPF) is a Linux kernel bytecode interpreter originally\nintroduced to filter network packets, e.g. for tcpdump and socket filters. The\nBPF instruction set and surrounding architecture has recently been\nsignificantly reworked with additional data structures such as hash tables and\narrays for keeping state as well as additional actions to support packet\nmangling, forwarding, encapsulation, etc. Furthermore, a compiler back end for\nLLVM allows for programs to be written in C and compiled into BPF instructions.\nAn in-kernel verifier ensures that BPF programs are safe to run and a JIT\ncompiler converts the BPF bytecode to CPU architecture specific instructions\nfor native execution efficiency. BPF programs can be run at various hooking\npoints in the kernel such as for incoming packets, outgoing packets, system\ncalls, kprobes, uprobes, tracepoints, etc.\n\nBPF continues to evolve and gain additional capabilities with each new Linux\nrelease. Cilium leverages BPF to perform core data path filtering, mangling,\nmonitoring and redirection, and requires BPF capabilities that are in any Linux\nkernel version 4.8.0 or newer (the latest current stable Linux kernel is\n4.14.x).\n\nMany Linux distributions including CoreOS, Debian, Docker's LinuxKit, Fedora,\nopenSUSE and Ubuntu already ship kernel versions >= 4.8.x. You can check your Linux\nkernel version by running ``uname -a``. If you are not yet running a recent\nenough kernel, check the Documentation of your Linux distribution on how to run\nLinux kernel 4.9.x or later.\n\nTo read up on the necessary kernel versions to run the BPF runtime, see the\nsection Prerequisites_.\n\n.. image:: https://cdn.rawgit.com/cilium/cilium/master/Documentation/images/bpf-overview.png\n :align: center\n\nXDP is a further step in evolution and enables to run a specific flavor of BPF\nprograms from the network driver with direct access to the packet's DMA buffer.\nThis is, by definition, the earliest possible point in the software stack,\nwhere programs can be attached to in order to allow for a programmable, high\nperformance packet processor in the Linux kernel networking data path.\n\nFurther information about BPF and XDP targeted for developers can be found in\nthe `BPF and XDP Reference Guide`_.\n\nTo know more about Cilium, it's extensions and use cases around Cilium and BPF\ntake a look at `Further Readings `_ section.\n\nCommunity\n=========\n\nSlack\n-----\n\nJoin the Cilium `Slack channel `_ to chat with\nCilium developers and other Cilium users. This is a good place to learn about\nCilium, ask questions, and share your experiences.\n\nSpecial Interest Groups (SIG)\n-----------------------------\n\nSee `Special Interest groups\n`_ for a list of all SIGs and their meeting times.\n\nWeekly Developer meeting\n------------------------\n* The developer community is hanging out on zoom on a weekly basis to chat.\n Everybody is welcome.\n* Weekly, Monday, 8:00 am PT, 11:00 am ET, 5:00 pm CEST\n* `Join zoom `_\n\nLicense\n=======\n\nThe cilium user space components are licensed under the\n`Apache License, Version 2.0 `_. The BPF code templates are licensed\nunder the `General Public License, Version 2.0 `_.\n\n.. _`Why Cilium?`: http://docs.cilium.io/en/stable/intro/#why-cilium\n.. _`Getting Started`: http://docs.cilium.io/en/stable/gettingstarted/\n.. _`Architecture and Concepts`: http://docs.cilium.io/en/stable/concepts/\n.. _`Installing Cilium`: http://docs.cilium.io/en/stable/gettingstarted/#installation\n.. _`Frequently Asked Questions`: https://github.com/cilium/cilium/issues?utf8=%E2%9C%93&q=is%3Aissue+label%3Akind%2Fquestion+\n.. _Contributing: http://docs.cilium.io/en/stable/contributing/development/\n.. _Prerequisites: http://docs.cilium.io/en/doc-1.0/install/system_requirements\n.. _`BPF and XDP Reference Guide`: http://docs.cilium.io/en/stable/bpf/\n.. _`eBPF`: https://ebpf.io\n.. _`eBPF.io`: https://ebpf.io\n\n.. |logo| image:: https://cdn.rawgit.com/cilium/cilium/master/Documentation/images/logo.svg\n :alt: Cilium Logo\n :width: 350px\n\n.. |build-status| image:: https://jenkins.cilium.io/job/cilium-ginkgo/job/cilium/job/master/badge/icon\n :alt: Build Status\n :scale: 100%\n :target: https://jenkins.cilium.io/job/cilium-ginkgo/job/cilium/job/master/\n\n.. |go-report| image:: https://goreportcard.com/badge/github.com/cilium/cilium\n :alt: Go Report Card\n :target: https://goreportcard.com/report/github.com/cilium/cilium\n\n.. |go-doc| image:: https://godoc.org/github.com/cilium/cilium?status.svg\n :alt: GoDoc\n :target: https://godoc.org/github.com/cilium/cilium\n\n.. |rtd| image:: https://readthedocs.org/projects/docs/badge/?version=latest\n :alt: Read the Docs\n :target: http://docs.cilium.io/\n\n.. |apache| image:: https://img.shields.io/badge/license-Apache-blue.svg\n :alt: Apache licensed\n :target: https://github.com/cilium/cilium/blob/master/LICENSE\n\n.. |gpl| image:: https://img.shields.io/badge/license-GPL-blue.svg\n :alt: GPL licensed\n :target: https://github.com/cilium/cilium/blob/master/bpf/COPYING\n\n.. |slack| image:: https://cilium.herokuapp.com/badge.svg\n :alt: Join the Cilium slack channel\n :target: https://cilium.herokuapp.com/\n\n.. |cii| image:: https://bestpractices.coreinfrastructure.org/projects/1269/badge\n :alt: CII Best Practices\n :target: https://bestpractices.coreinfrastructure.org/projects/1269\n\n.. |pulls| image:: https://img.shields.io/docker/pulls/cilium/cilium.svg\n :alt: Cilium pulls\n :target: https://hub.docker.com/r/cilium/cilium/tags/\n","has_starred","hub_user","immutable_tags_settings",{"_135":11,"_136":137},"enabled","rules",[138],".*","is_automated","permissions",{"_142":17,"_143":11,"_144":11},"read","write","admin","user","storage_size",5859333443,"isOrg","reponame","tag","canDeleteTags","isHubSbxKitsEnabled","currentTab","tagAttestations","displaySecurityMetadata","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)._index",{"_23":24,"_96":-7,"_94":-7,"_95":-7,"_25":158,"_40":58,"_162":163,"_167":11},{"_27":28,"_29":30,"_31":32,"_33":34,"_35":159,"_62":63,"_64":30,"_65":66,"_67":68,"_69":70,"_71":72,"_73":59,"_74":63,"_75":54,"_76":17},[160,161],{"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":43,"_51":-5,"_52":32,"_53":54,"_55":-5},{"_38":57,"_40":58,"_42":43,"_44":59,"_46":60,"_48":49,"_50":43,"_51":-5,"_52":61,"_53":54,"_55":-5},"imageWithLayers",{"_38":57,"_40":58,"_42":43,"_44":59,"_46":60,"_80":164,"_48":49,"_50":43,"_51":-5,"_52":61,"_53":54,"_55":-5},[165,166],{"_52":83,"_84":85,"_40":43},{"_40":87,"_52":61,"_84":88},"hasPermissionToViewRepoSettings","actionData","errors"]

cilium/cilium-runtime-dev:2fb621b69366fad1300a7e9bf09d2acff01cadf2