Tetragon in AWS CodeBuild blocks npm postinstall network access

An engineer reproduced a KubeCon Japan 2026 demo in AWS CodeBuild, using eBPF-based Tetragon to block network connections from npm postinstall scripts. In enforce mode curl was killed with SIGKILL and the request never reached the test server.

• TracingPolicy kills /usr/bin/curl when connecting outside 127.0.0.0/8
• In enforce mode curl exited with SIGKILL and no receive record was created
• In baseline and observe modes the request succeeded and npm ci finished normally
• Tetragon started in PRE_BUILD on Amazon Linux with LINUX_KERNEL_6