> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/caas-workloads.md).

# CaaS Workloads

Deploy the Cortex Cloud container-embedded agent on Container as a Service (CaaS) environments to extend runtime security and vulnerability scanning to containerized workloads. The container-embedded Cortex XDR agent provides malware prevention, exploit protection, vulnerability assessment, and altered binary execution restriction for containers running on managed container services.

The Cortex Cloud container-embedded agent is a purpose-built agent designed for containerized environments. The agent embeds directly into your existing workflows.

The container-embedded agent is embedded directly into your container image during the Docker build process. The agent runs as an entry point within your application container, providing runtime security and vulnerability scanning without requiring a separate container.

This topic explains the process of how to embed the Cortex XDR agent in your dockerfile:

{% hint style="info" %}

### License

Requires the Cortex Cloud Runtime Security add-on. Every 10 container-embedded agents will consume a single Cortex Runtime Security license.
{% endhint %}

#### **CaaS container-embedded agent installer**

The following managed container services are supported. See the prerequisites tables below for the requirements and limitations:

* AWS ECS Fargate; containers using x86\_64 and AArch64 architecture
* Azure Container Instances (ACI); containers using x86\_64 architecture
* Google Cloud Run (GCR); containers using x86\_64 architecture

#### Prerequisites

Before you deploy the container-embedded agent, verify the following:

<table><thead><tr><th width="250.25">Prerequisite</th><th>Details</th></tr></thead><tbody><tr><td>Supported Environment</td><td>AWS ECS Fargate; containers using x86_64 and aarch64 architecture</td></tr><tr><td>Requirements</td><td><p>Cortex XDR agent version 9.2.0 or later</p><p>Required resources per container:</p><ul><li>Disk space: 1.5 GB</li><li>1 CPU</li><li>Memory: 512 MB</li></ul><p>Dockerfile requirements:</p><ul><li>SYS_PTRACE must be enabled</li></ul><p>Assets discovery: Onboard the relevant AWS environments</p><p>Drift detection: Container registry image scanning</p></td></tr><tr><td>Limitations</td><td><ul><li>ENTRYPOINT/CMD must not be added to the task_definition.</li><li>ENTRYPOINT cannot be run in exec format with the CMD shell command.</li><li>AArch64-based architecture does not support exploit protection mechanisms.</li></ul></td></tr></tbody></table>

<table><thead><tr><th width="250.25">Prerequisite</th><th>Details</th></tr></thead><tbody><tr><td>Supported Environment</td><td>Azure Container Instances (ACI) containers using x86_64 architecture</td></tr><tr><td>Requirements</td><td><p>Cortex XDR agent version 9.3.0 or later</p><p>In your YAML deployment file, define the following:</p><p>a) Required resources per container:</p><ul><li>1 CPU</li><li>Memory: 1.5 GB</li></ul><p>b) Azure container registry credentials imageRegistryCredentials:</p><p>Server: Full ACR</p><p>Username: Access Key Admin Username</p><p>Password: Access Key Admin User Password</p><p>c) There are two valid identity options, one of these identities must be defined:</p><ul><li>System Identity</li><li>User Identity</li></ul><p>d) The relevant identity must have Reader and AcrPull permissions</p><p><br>e) securityContext: privileged: true</p><p>f) For the User Identity option, assign the following Environment Variables:</p><ul><li>UAMI_CLIENT_ID_XDR: User assigned Client ID</li><li>SUB_ID_XDR: Azure subscription ID</li><li>RG_XDR: Resource Group</li><li>ACI_NAME_XDR: Container name</li></ul></td></tr><tr><td>Supported deployments</td><td><ul><li>System Identity: System-Assigned Managed Identity</li><li>Identity Permissions: Identity has Reader access to the Container Instance resource</li><li>Image Resolution: Image referenced by digest</li><li><p>User Identity: User-Assigned Managed Identity<br>For User Identity deployment, user must also define the following environment variables:</p><ul><li>SUBSCRIPTION_ID_FOR_CORTEX</li><li>RESOURCE_GROUP_FOR_CORTEX</li><li>CONTAINER_INSTANCE_NAME_FOR_CORTEX</li></ul></li></ul></td></tr></tbody></table>

<table><thead><tr><th width="250.25">Prerequisite</th><th>Details</th></tr></thead><tbody><tr><td>Supported Environment</td><td>Google Cloud Run (GCR) containers using x86_64 architecture</td></tr><tr><td>Requirements</td><td><p>Cortex XDR agent version 9.3.0 or later</p><p>a) Required resources per container:</p><ul><li>1 CPU</li><li>Memory: 1.5 GB</li></ul><p>b) Dockerfile requirement:</p><p>For log retention, set the environment variable path:</p><p>XDR_LOG_DIR = &#x3C;/opt/traps/log></p><p>Note: The only path not supported is</p><p>/var/log or any child path from it.</p></td></tr><tr><td>Supported deployments</td><td><ul><li>Service Account Permissions: Service account has roles/run.viewer (Cloud Run Viewer)</li><li>Cloud Run Service: Container Count (Up to 2 containers per Service)</li><li>Cloud Run Job: Container Count (Up to 1 container per Job)</li></ul></td></tr><tr><td>Limitations</td><td><ul><li>Instance-based billing only</li><li>Execution environment: Second Generation and above</li></ul></td></tr></tbody></table>

**Create the Cortex Cloud container-embedded agent Dockerfile via API:**

See the API reference guide: [Create Distributions](broken://spaces/ZuJbX2x7VQJhNovscCwE/pages/275fde161708b6a95f046c13d1b2b73adf8b05b2#create-distributions)

Create the Cortex Cloud container-embedded agent Dockerfile via user interface:

1. In your Cortex management console, navigate to **Inventory** → **Endpoints** → **Installations**, click Create.
2. Select **CaaS** as the Package Type and in Parameters select **Container Embedded** as the Deployment Type.
   1. Select the installer details to define the configuration settings for version and proxy (optional).
   2. Upload your Dockerfile. Cortex Cloud validates your Dockerfile against the [prerequisites](#prerequisites).
3. A new Agent Installation instance will be created - right click it and download the newly generated Dockerfile.

Embed the Cortex Cloud container-embedded agent Dockerfile into your container image:

1. Select the newly generated Dockerfile.
2. Re-build your container image using the newly generated Dockerfile.
3. During the build process, the agent binary will be fetched from the Cortex repository and baked into the image.
4. Once the build process is successfully finished, you are ready to use the new container image in your CaaS environments, based on the prerequisites above.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/caas-workloads.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.