System Requirements
Standalone Mode
The standalone CLI runs on Linux (x86_64 and arm64). No Kubernetes required.
| Requirement | Details |
|---|---|
| Platform | Linux x86_64 / arm64 |
| Container runtime | Docker, Podman, containerd, or CRI-O (auto-detected) |
| Internet | Required for first run (downloads Trivy/ClamAV); use --offline after |
| Disk | ~250MB for cached tools (Trivy + ClamAV) at ~/.cache/reel/ |
Agent Mode: Kubernetes
| Version | Status | Notes |
|---|---|---|
| v1.30+ | Recommended | Checkpoint API enabled by default (beta) |
| v1.25 - v1.29 | Supported | Checkpoint API requires feature gate |
Also required
- • Helm 3.x
- • containerd 2.0+ or CRI-O 1.25+
Node OS
| OS | Status |
|---|---|
| Ubuntu 22.04+ | Supported |
| Amazon Linux 2023 | Supported |
| Red Hat Enterprise Linux | Supported |
| Talos, Bottlerocket, Flatcar (immutable) | Supported |
Both linux/amd64 and linux/arm64 nodes are supported. The agent and init images ship as multi-arch manifests.
Cloud Providers
GKE, EKS, and AKS standard clusters are supported.
Serverless options (GKE Autopilot, EKS Fargate) aren't supported. They don't give the agent the node-level access it needs.
CRIU / Checkpoint
Checkpoint/restore is opt-in. Enable it at install with --set initCriu.enabled=true and an init container installs a patched CRIU v4.2 onto the host. It needs a writable host filesystem, so it's not available on immutable-OS nodes (Talos, Bottlerocket, Flatcar). The underlying Kubernetes ContainerCheckpoint feature is still beta.
Everything else (SBOM, CBOM, malware, layers, and live memory capture) does not use CRIU and works on any supported node, including immutable ones.
Resources
Measured with 3 concurrent 5GB layer captures. Adjust based on workload.
| Component | CPU Request | CPU Limit | Memory Request | Memory Limit |
|---|---|---|---|---|
| Agent | 250m | 1000m | 128Mi | 256Mi |
| ClamAV (optional) | 100m | 500m | 1Gi | 2Gi |
ClamAV loads signature database into memory on startup (~1GB). The scheduler limits concurrency to 3 checkpoints and 2 layers at a time, with a 5-minute timeout per operation.
Storage sizing
Checkpoint and layer artifact sizes track the container's filesystem footprint. Layers only contain the diff from the base image, so a container that wrote little is far smaller than its image:
| Container Size | Approximate Artifact Size |
|---|---|
| 100MB | ~50-100MB |
| 500MB | ~200-400MB |
| 1GB+ | ~500MB-1GB |
Artifacts uploaded via upload stream to S3 and the server-side copy is deleted immediately. Apply S3 lifecycle rules to age out evidence. For node-local cleanup, delete layer <layer-id> removes a single capture, and delete checkpoint --older-than prunes checkpoints by age.