CaaS Workloads ↗

Deploy the Cortex XDR container-embedded agent on Container as a Service (CaaS) environments to extend runtime security and vulnerability scanning to containerized workloads. The container-embedded Cortex XDR agent provides malware prevention, exploit protection, vulnerability assessment, and altered binary execution restriction for containers running on managed container services.

The Cortex XDR container-embedded agent is a purpose-built agent designed for containerized environments. The agent embeds directly into your existing workflows.

The container-embedded agent is embedded directly into your container image during the Docker build process. The agent runs as an entry point within your application container, providing runtime security and vulnerability scanning without requiring a separate container.

This topic explains the process of how to embed the Cortex XDR agent in your dockerfile.

Notice

This feature requires a Cloud Runtime Security or Cortex XSIAM Premium license. Every 10 container-embedded agents will consume a single Cortex Runtime Security license.

CaaS container-embedded agent installer

The following managed container services are supported. See the prerequisites tables below for the requirements for each container service.

• AWS ECS Fargate; containers using x86_64 and AArch64 architecture
• Azure Container Instances (ACI); containers using x86_64 architecture
• Google Cloud Run (GCR); containers using x86_64 architecture

Prerequisites

Before you deploy the container-embedded agent, verify the following:

Prerequisite	Details
Supported Environment	AWS ECS Fargate; containers using x86_64 and aarch64 architecture
Requirements	Cortex XDR agent version 9.2.0 or later Required resources per container: Disk space: 1.5 GB 1 CPU Memory: 512 MB Dockerfile requirements: SYS_PTRACE must be enabled Assets discovery: Onboard the relevant AWS environments Drift detection: Container registry image scanning
Limitations	ENTRYPOINT/CMD must not be added to the task_definition. ENTRYPOINT cannot be run in exec format with the CMD shell command. AArch64-based architecture does not support exploit protection mechanisms.

Prerequisite	Details
Supported Environment	Azure Container Instances (ACI) containers using x86_64 architecture
Requirements	Cortex XDR agent version 9.3.0 or later In your YAML deployment file, define the following: a) Required resources per container: 1 CPU Memory: 1.5 GB b) Azure container registry credentials imageRegistryCredentials: Server: Full ACR Username: Access Key Admin Username Password: Access Key Admin User Password c) There are two valid identity options, one of these identities must be defined: System Identity User Identity d) The relevant identity must have Reader and AcrPull permissions e) securityContext: privileged: true f) For the User Identity option, assign the following Environment Variables: UAMI_CLIENT_ID_XDR: User assigned Client ID SUB_ID_XDR: Azure subscription ID RG_XDR: Resource Group ACI_NAME_XDR: Container name
Supported deployments	System Identity: System-Assigned Managed Identity Identity Permissions: Identity has Reader access to the Container Instance resource Image Resolution: Image referenced by digest User Identity: User-Assigned Managed Identity For User Identity deployment, user must also define the following environment variables: SUBSCRIPTION_ID_FOR_CORTEX RESOURCE_GROUP_FOR_CORTEX CONTAINER_INSTANCE_NAME_FOR_CORTEX

Prerequisite	Details
Supported Environment	Google Cloud Run (GCR) containers using x86_64 architecture
Requirements	Cortex XDR agent version 9.3.0 or later a) Required resources per container: 1 CPU Memory: 1.5 GB b) Dockerfile requirement: For log retention, set the environment variable path: XDR_LOG_DIR = </opt/traps/log> Note: Do not use /var/log or any subdirectories from it.
Supported deployments	Service Account Permissions: Service account has roles/run.viewer (Cloud Run Viewer) Cloud Run Service: Container Count (Up to 2 containers per Service) Cloud Run Job: Container Count (Up to 1 container per Job)
Limitations	Instance-based billing only Execution environment: Second Generation and above

To create the Cortex XDR container-embedded agent Dockerfile via API.

See the API reference guide: Create distributions

To create the Cortex XDR container-embedded agent Dockerfile via user interface:

1. In your Cortex management console, navigate to Inventory → Endpoints → Installations, click Create.
2. Select CaaS as the Package Type and in Metadata, select Container Embedded as the Deployment Type.
   1. Define the configuration settings for version and proxy (optional).
   2. Upload your Dockerfile. Cortex XSIAM validates your Dockerfile against the prerequisites.
3. A new Agent Installation instance will be created- right-click it and download the newly generated Dockerfile.

Embed the Cortex XDR container-embedded agent Dockerfile into your container image:

1. Select the newly generated Dockerfile.
2. Re-build your container image using the newly generated Dockerfile.
3. During the build process, the agent binary will be fetched from the Cortex repository and baked into the image.
4. Once the build process is successfully finished, you are ready to use the new container image in your CaaS environments, based on the prerequisites above.