Self-Healing Container Clusters: Context-Aware Anomaly Detection and Automated Remediation Using eBPF Telemetry

Modern cloud-native microservice architectures rely on container orchestration frameworks such as Kubernetes to maintain continuous operational availability. However, traditional user-space monitoring solutions often impose significant performance overhead and fail to provide the granular kernel-level observability required for rapid, context-aware fault detection. In this paper, we propose AegisK8s, a novel self-healing framework for container clusters that combines kernel-level telemetry gathered via Extended Berkeley Packet Filter (eBPF) with a context-aware anomaly detection model and an automated remediation engine. By inspecting syscall events, network socket states, and memory allocations in real time at the kernel layer, AegisK8s captures high-fidelity operational metrics without requiring code instrumentation or heavy sidecar proxies. Our context-aware anomaly detection algorithm utilizes a lightweight Isolation Forest model integrated with dynamic workload graph contextualization to differentiate benign operational spikes from genuinely anomalous behaviors, such as memory leaks, deadlocks, and noisy-neighbor interference. Upon anomaly verification, an automated policy-driven engine orchestrates targeted remediation actions ranging from localized cgroup throttling to container restarts and dynamic pod rescheduling. We evaluated AegisK8s on a 50-node Kubernetes cluster running multi-tier benchmark applications under simulated operational faults. Experimental results demonstrate that AegisK8s achieves a 98.4% anomaly detection accuracy with a mean remediation latency of 418 milliseconds, while maintaining a runtime overhead of less than 1.8% CPU usage. These findings highlight the viability of eBPF-driven autonomous operations for resilient cloud computing environments.