landlock-genprof

landlock-genprof synthesize

Re-runs synthesis offline from previously captured evidence

Synopsis

Re-runs synthesis from a training run’s persisted evidence (see trace --events-out), without re-tracing — produces the same PodLock profile and candidate JSON trace writes inline. Deliberately minimal today: unlike trace, this doesn’t write NetworkPolicy/seccomp/capabilities/securityContext/report, doesn’t record history, and doesn’t publish a SecurityProfileProposal — those all need a live cluster connection this command doesn’t have.

Installed as a kubectl plugin (the common case): run this as kubectl landlock-genprof <command>. Running this binary directly instead (standalone, not via kubectl) works the same way, without that prefix.

landlock-genprof synthesize --events-file <path> --pod <name> --container <name> --binary <path> [flags]

Examples

  kubectl landlock-genprof synthesize --events-file nginx-demo-events.json \
    --pod nginx-demo --namespace default --container nginx --binary /usr/sbin/nginx --candidate-out

Options

      --binary string                Binary path to label the generated profile with (required)
      --candidate-out verify[="-"]   Output file for the raw candidate JSON (default <pod>-candidate.json); this is what verify reads
  -c, --container string             Container name to label the generated profile with (required)
      --events-file string           Path to an evidence JSON file (see trace --events-out) (required)
  -h, --help                         help for synthesize
  -n, --namespace string             Namespace to label the generated profile with (default "default")
  -o, --out string                   Output file for the generated LandlockProfile (default: <pod>-profile.yaml)
  -p, --pod string                   Pod name to label the generated profile with (required)

SEE ALSO

• landlock-genprof - Generates least-privilege Kubernetes security profiles by observing a running pod