Welcome to BarkOps Documentation
Continuous Dynamic Supply Chain Observability is a paradigm shift in software security. Rather than relying on static scans taken during build-time inside CI/CD pipelines, BarkOps shifts the primary source of truth directly into the active production environment.
Why BarkOps?
Security scanners typically evaluate application components when they are built. However, in modern cloud-native environments, significant blind spots occur after the deployment has passed green:
- Runtime Drift: Hand-crafted hotfixes, direct changes via
kubectl edit, or dynamic registry updates mutate running configurations from their original declared Git states. - Schatten-IT (Shadow IT): Containers deployed directly to hosts bypassing standard pipeline scans completely evade static security scanners.
- Container Rot: Even if an image was 100% secure at build-time, new critical vulnerabilities (CVEs) are disclosed continuously. Without active runtime monitoring, you are blind to "rotting" code running on production clusters.
Core Pillars of BarkOps
| Pillar | Focus | Deliverable |
|---|---|---|
| Observability | Sniffs real-time running container tags & SHA256 digests. | Dynamic Asset Inventory |
| Generation | Context-specific Software Bill of Materials (SBOM) compiled on-the-fly. | CycloneDX Schemas |
| Compliance | Automated evidence collection to satisfy strict audits. | NIS2 Article 21 SLA Tracking |
| Mitigation | Runtime risk advisories, security context auditing, and recommended NetworkPolicies. | Active Advisor Recommendations |
Quick Start Guide
Getting started with BarkOps takes less than 5 minutes. The Sniffer agent requires no code modifications or recompilation.
1. Install the Lightweight Sniffer Agent
Run the daemon set on your Kubernetes nodes or Docker host:
# For Docker hosts
docker run -d --name barkops-sniffer \
-v /var/run/docker.sock:/var/run/docker.sock \
-e CENTRAL_ENDPOINT="https://central.barkops.io" \
barkops/sniffer:latest
2. Connect your Cluster
Once installed, the sniffer establishes a secure, encrypted socket connection to BarkOps Central. Running containers are discovered instantly and displayed in your centralized dashboard.
Frequently Asked Questions
Does the sniffer introduce overhead?
No. The sniffer utilizes lightweight OS event notifications (using native container socket event observations) and operates outside the primary data-path, introducing zero latency or performance overhead to your production services.
Can we use BarkOps alongside existing static scanners?
Absolutely. We treat static pipeline scanners as optional, separate modules. BarkOps is designed to capture the actual state of production, regardless of origin, and operates fully independently of any development pipelines.