Most developer tooling treats Kubernetes as a deployment target for application workloads - but what if it became the development environment itself? Running interactive workspaces natively on Kubernetes offers compelling advantages: developers work in environments that mirror production, teams share cluster resources more efficiently, and ephemeral workspaces can be spun up and torn down on demand. This is the vision driving k8shell, our Kubernetes-native workspace project.

But as these environments mature, they introduce a security challenge the ecosystem has yet to fully address. Interactive workspaces are long-lived and user-driven, and they often require elevated privileges by design - making them a high-value target once an attacker gains access to the cluster. Traditional perimeter security offers little protection at this layer.

This session introduces Worktrace, a real-time threat detection system we built to address exactly this gap. Worktrace uses eBPF-based kernel observability to identify malicious activity inside live Kubernetes workspaces. It combines three detection strategies: rule-based matching for known attack signatures, multi-step attack path correlation, and behavioral anomaly detection. Detection rules are defined declaratively in YAML, capturing both the detection logic and the instrumentation scope in one place. The system deploys as a Kubernetes DaemonSet alongside Cilium Tetragon and integrates natively into standard monitoring infrastructure.

We'll walk through controlled penetration testing results across ten distinct attack techniques, including container escapes via privileged mode, kernel module injection, ptrace-based process injection, and Kubernetes-level privilege escalation. They were all successfully detected at under 3% node CPU overhead and less than 14 MiB of memory per node.