landlock-genprof doctor
Checks this host’s (or a given kernel version’s) Landlock/eBPF prerequisites
Synopsis
Checks that a kernel supports Landlock (filesystem and network) and, for the local host, that eBPF’s bpffs is mounted — the same checks hack/check-kernel.sh has always run, now built into the CLI itself instead of a separate shell script a user has to already know exists. –kernel lets you check a kernel you’re not currently running on (a fleet’s node-pool version, for instance) without needing to run this on that host directly.
Installed as a kubectl plugin (the common case): run this as kubectl landlock-genprof <command>. Running this binary directly instead (standalone, not via kubectl) works the same way, without that prefix.
landlock-genprof doctor [flags]
Examples
kubectl landlock-genprof doctor
kubectl landlock-genprof doctor --kernel 5.15.0
Options
-h, --help help for doctor
--kernel string Check this kernel version instead of the current host's (e.g. 5.15.0)
SEE ALSO
- landlock-genprof - Generates least-privilege Kubernetes security profiles by observing a running pod