eBPF Monitoring
Stream syscall activity from Docker workloads and Linux hosts with low-overhead kernel visibility.
Stackdog Security v0.2.4
AI-Powered Security for Docker Containers & Linux Servers
Real-time threat detection using eBPF syscall monitoring. Zero-overhead security that scales with your containers.
Install in one line
Ship runtime protection in minutes with the official installer.
curl -fsSL https://raw.githubusercontent.com/trydirect/stackdog/main/install.sh | sudo bashBuilt for operators
Start the API with stackdog serve and stream live events through /ws.
AI on your terms
Pair local Ollama with OpenAI-compatible APIs or native Candle-backed models.
<5%
CPU overhead
25+
Built-in detectors
4
Alert channels
Real-time
Detection loop
Feature overview
Everything you need for runtime security at container speed
Stackdog combines runtime telemetry, AI-assisted analysis, and automated enforcement so small platform teams can investigate and contain threats without stitching together half a dozen tools.
AI/ML Detection
An Isolation Forest model learns your normal log patterns and flags behavioral drift, alongside OpenAI, Ollama, and Candle-backed analysis.
AI Tool Use
The analyzer can call back into Stackdog mid-investigation to check IP reputation, inspect container posture, review recent alerts, and ban attackers.
Log Sniffing & Analysis
Discover logs, summarize incidents, archive evidence, and keep operators focused on what matters.
Automated Response
Ban attacking IPs through nftables or iptables, quarantine suspicious containers, and release bans automatically when the ban window expires.
Posture & Integrity Audits
Track file integrity against SQLite baselines, audit SSH, sudoers, and Docker daemon settings, and flag privileged containers or exposed Docker sockets.
Multi-Channel Alerts
Route incidents to Slack, email, or webhooks, filtered by minimum severity and deduplicated so a standing misconfiguration does not page you all day.
Threat Scoring
Prioritize with built-in signatures, heuristics, and scoring that helps teams act on the highest-risk events first.
How it works
Install, monitor, and respond from one control loop
01
Install
Deploy Stackdog with a one-line install, a pinned release, or the published Docker image.
02
Monitor
Collect syscalls, container telemetry, and logs while the rule engine and AI analyzers watch for anomalies.
03
Respond
Push alerts, score threats, and automatically firewall or quarantine suspicious workloads.
API & CLI ready
Stream incidents into your workflows in real time
Stackdog ships with a clean REST API and WebSocket feed, so you can wire dashboards, runbooks, ticket automation, or chatops around the same event stream that powers the built-in security engine.
stackdog serve on port 5000WebSocket updates at /ws
Core endpoints
- GET /api/security/status
- GET /api/threats
- GET /api/alerts
- GET /api/containers
- GET /api/logs/summaries
- WebSocket /ws
Frequently asked questions
Answers for operators, platform teams, and security engineers
These common questions are optimized for both human readers and AI search engines, so buyers and assistants can quickly understand where Stackdog fits.
What is Stackdog Security?
Stackdog Security is a Rust-based runtime security platform for Docker containers and Linux servers. It combines eBPF monitoring, AI-assisted log analysis, threat scoring, and automated response in one stack.
How does Stackdog monitor containers?
Stackdog uses eBPF-based syscall monitoring and container-aware telemetry to observe workload behavior with low overhead. It also inspects logs and Docker metadata to enrich detections.
What AI providers does Stackdog support?
Stackdog can work with OpenAI-compatible APIs, local Ollama deployments, and Candle-powered Rust inference workflows. Teams can choose the provider that best matches their security and cost requirements.
Does Stackdog support Kubernetes?
Stackdog can already recognize Kubernetes-style container identifiers in runtime paths, but broader Kubernetes support is still on the roadmap. Today the primary deployment target is Docker containers and Linux servers.
How does Stackdog respond to threats?
Stackdog can score events, notify responders, push Slack or webhook alerts, update nftables or iptables rules, and quarantine suspicious containers as part of an automated response pipeline. Bans expire on their own, and you can also ban an address by hand with stackdog ban-ip.
How does Stackdog avoid alert fatigue?
Alerts are filtered by a minimum severity you set, and repeats of the same finding are suppressed for a configurable window (six hours by default). Standing misconfigurations are re-detected on every pass, so without this they would notify all day. Each alert also names the real source, such as the container or log file it came from.
Is Stackdog open source?
Yes. Stackdog is open source on GitHub under the MIT license, so teams can audit the code, run it themselves, and contribute improvements.
What platforms does Stackdog support?
Stackdog is built for Docker containers and Linux servers. The core platform is written in Rust, and optional machine learning features use Candle for native Rust inference.
How do I get started?
Install Stackdog with the one-line script or Docker image, then review the CLI and API docs to start monitoring your infrastructure. From there you can configure AI providers, alert channels, and response actions.
Open source security
View on GitHubStart protecting your infrastructure today
Install Stackdog, connect your alerting channels, and bring AI-assisted runtime detection to your Docker and Linux workloads.