the black box recorder for regulated kubernetes
reel takes forensic snapshots of every live container: processes, memory, filesystem, packages, crypto, and threats. The evidence lands in your S3 vault, timestamped, before any reporting clock starts.
runtime evidence
reel turns raw container state into security evidence.
continuous compliance
Use reel to scan images in your CI/CD pipeline or live containers in development environments and production Kubernetes clusters. Extract forensic evidence, assess security posture and compliance at runtime, continuously.
One-shot scans from your terminal or CI pipeline.
Deploy once. reel scans every pod in your Kubernetes cluster and uploads the evidence to S3, on a schedule.
// runs on every node — even immutable OSes like Talos, Bottlerocket & Flatcar, where you can't SSH in
model context protocol
reel answers Claude Code, Cursor, and Continue with live state from your running containers: SBOMs, crypto, processes, files, and memory. The runtime context every AI security scanner needs.
What's actually exploitable in the nginx container?
→ sbom · vuln + vendor VEX
287 CVEs · 263 ruled out by vendor VEX · 24 to triage
Any weak crypto or malware inside?
→ cbom · malware
2 RSA-1024 keys · no malware found
What else is running on that node?
→ list_workloads
redis · postgres · nginx · 3 sidecars