Overview/Features/Kubernetes & Docker
Kubernetes & DockerThe cluster, verified.
Nothing installed in it.
PathMRI treats a cluster the way it treats a host: predict what the policy and topology intend, probe what actually happens from inside the pod, and reconcile the two. It runs over an SSH session to a node — there is nothing to deploy into the cluster and nothing to clean up afterwards.
What it does inside a cluster
The whole inventory
Nodes, namespaces, pods with their owners and security context, Deployments, ReplicaSets, StatefulSets, DaemonSets, Jobs and CronJobs, Services with their real endpoints, Ingresses and RBAC bindings — parsed into the same models everything else on the map uses.
Policy that is evaluated, not listed
Native NetworkPolicy, plus ordered Calico with its tiers and Cilium. The question is not which policies exist; it is which one decides this flow.
Probed from inside the pod
The reachability matrix, exposure scan, egress and DNS checks are made from the pod's own network namespace — the path the workload really takes, including the CNI's masquerade.
Broken things, named
A selector Service with zero endpoints is flagged rather than shown as healthy, and a DaemonSet short of node coverage is visible as a gap rather than a number you have to compare yourself.
Docker, on the same contract
Container networks, published ports and bridge masquerade are modelled with the same declared-versus-observed NAT contract every appliance gets — and gated on the network driver, because host, macvlan and ipvlan translate nothing.
Clusters with no node SSH
A cluster reachable only through a kubeconfig on the controller — kind, Docker Desktop, a bastion context — still gives inventory and drift. The in-pod probes need node SSH, and the product says so rather than failing quietly.
kubectl, crictl, jq, ss and dig on the
node. Nothing is installed in the cluster, and nothing is left on the nodes.