System requirements

Before installing Prisma Cloud, verify that your environment meets the minimum requirements.

For information about when Prisma Cloud adds and drops support for third party software, see our support lifecycle page.

The following sections describe the system requirements in detail.

Hardware

Prisma Cloud supports x86_64 and ARM64 architectures. Ensure that your systems meet the following hardware requirements.

Defender Resource Requirements

Each Defender requires 256MB of RAM, 8GB of host storage, and 256m CPU.

256m is the requested CPU value and not the limit. The limit in Defenders is set to 900m. For limits and requested value, refer to the daemonset.yaml file, which you can download from the Prisma Cloud console.

The Defender uses cgroups v1 or v2 to cap resource usage at 512MB of RAM and 900 CPU shares where a typical load is ~1-5% CPU and 30-70MB RAM.

For every additional 5,000 Defenders beyond 10,000 Defenders, you need 4 CPUs and 10GB RAM. For example, if there are 20,000 connected Defenders, you require 16 vCPUs, 50GB of RAM, and 500GB SSD of persistent storage.

If Defenders provide registry scanning they require the following resources:

2GB of RAM
20GB of storage
2 CPU cores

For Defenders that are a part of CI integrations such as Jenkins and twistcli, the amount of storage space required depends on the size of the scanned images. You will need disk space that is 1.5 times the size of the largest image to be scanned, per executor. For example, if you have a Jenkins instance with two executors and your largest container image is 500MB, you will need at least 1.5GB of storage space (500MB x 1.5 x 2).

Keep the following caveats in mind when determining Defender storage and memory requirements:

The Defender stores its data in the /var folder. When allocating disk space for Defender, ensure the required space is available in the /var folder.
Defenders are designed to be portable containers that collect data. Any data that must be persisted is sent to the Prisma Cloud Console for storage.
Defenders do not require persistent storage. Deploying persistent storage for Defenders can corrupt Defender files.
For Web Application and API Security (WAAS):
- Inline - Increase the pod memory to 4GB if the Defender is protecting more than 10 workloads.
- Out-Of-Band - Increase the pod memory to 4GB.

Virtual Machines (VMs)

Prisma Cloud has been tested on the following hypervisors:

VMware for Tanzu Kubernetes Grid Multicloud (TKGM)
VMware for Tanzu Kubernetes Grid Integrated (TKGI)

Cloud Platforms

Prisma Cloud can run on nearly any cloud Infrastructure as a Service (IaaS) platform.

Prisma Cloud has been tested on the following services:

Amazon Web Services (AWS)
Google Cloud Platform
IBM Cloud
Microsoft Azure
Oracle Cloud Infrastructure (OCI)
Alibaba Cloud: You can deploy Defenders on VMs, hosts running containers, and clusters on Alibaba Cloud using the instructions for the supported host operating systems and orchestrator versions. Specific deployment instructions for Alibaba Cloud are not documented and Cloud discovery is not supported.

ARM Architecture Requirements

The following setups support Prisma Cloud on ARM64 architecture:

Cloud provider
- AWS Graviton2 processors
- GCP GKE on ARM using the Tau T2A machine series
Supported Defenders:
- Orchestrator Defenders on AWS and GCP
- Host Defenders including auto-defend on AWS

The twistcli is supported on Linux ARM64 instances.

Learn more in the Supported Operating Systems on ARM64 and Supported Orchestrators on ARM64 sections.

The Prisma Cloud Console doesn’t support running on ARM64 systems.

Operating Systems for bare-metal Hosts and Virtual Machines

Prisma Cloud is supported on both x86_64 and ARM64

Supported Operating Systems on x86_64

Prisma Cloud is supported on the following host operating systems on x86_64 architecture:

Distro

Version

Kernel

Supported Kubelet

Supported runtime

Notes

Amazon Linux 2

AMI name: amzn2-ami-hvm-2.0.20230727.0-x86_64-gp2 AMI ID: ami-09748abeb7370d1bc

4.14.322-244.536.amzn2.x86_64

Amazon Linux 2023

AMI ID:ami-02396cdd13e9a1257

6.1.23-36.46.amzn2023.x86_64

Azure Linux docker image

20230426

Bottlerocket OS

1.9.2

1.26.2

containerd 1.6.19+bottlerocket

Defenders must be installed as privileged on Bottlerocket. The following features are not available for Bottlerocket: - Vulnerability and compliance blocking policies - RunC - Prevent on containerd runtime - Compliance for containerd

Bottlerocket OS

1.15.0

1.27.4

containerd://1.6.23+bottlerocket

Bottlerocket OS

1.15.0

1.27.4

containerd://1.6.23+bottlerocket

Bottlerocket OS

1.18.0

1.29.0

containerd://1.6.26+bottlerocket

CentOS

Debian

GCOOS

latest

GCOOS is purposefully minimalistic. It doesn’t support installing new packages or writing new bins. Hence, Prisma Cloud’s vulnerability detection on GCOOS only covers Docker and Kubernetes package binary detection. Runtime prevent capability is supported only for DNS events. Other prevent capabilities are not supported.

Oracle Enterprise Linux (OEL)

Agentless scanning is not supported for OEL 9. Vulnerabilities are matched by architecture, which leads to ARM images showing x86 relevant vulnerabilities and vice versa.

Red Hat Enterprise Linux (RHEL)

Red Hat Enterprise Linux CoreOS (RHCOS)

All versions included in OpenShift versions: 4.11,4.12 ,4.13, and 4.14

Rocky Linux

SUSE

SLES-12 SP5

OpenSUSE is not tested.

SUSE

SLES 15 SP1 - SP5

OpenSUSE is not tested.

Talos OS

1.3.0

5.15.83-talos

1.25.4

containerd 1.6.12

The following features are not available for Talos OS: - Scanning of underlying hosts - Agentless scanning - Vulnerability and compliance blocking policies - WAAS defense

Talos OS

1.3.3

5.15.89-talos

1.25.4

containerd 1.6.15

The following features are not available for Talos OS: - Scanning of underlying hosts - Agentless scanning - Vulnerability and compliance blocking policies - WAAS defense

Talos OS

1.5.1

6.1.46-talos

1.26.3

containerd 1.6.23

The following features are not available for Talos OS: - Vulnerability and compliance blocking policies - Agentless scanning

Talos OS

1.5.3

6.1.54-talos

1.26.3

containerd 1.6.23

The following features are not available for Talos OS: - Vulnerability and compliance blocking policies - Agentless scanning

Talos OS

1.5.5

6.1.61-talos

1.26.3

containerd 1.6.23

The following features are not available for Talos OS: - Vulnerability and compliance blocking policies - Agentless scanning

Talos OS

1.6.0

6.1.67-talos

1.26.3

containerd 1.7.10

The following features are not available for Talos OS: - Vulnerability and compliance blocking policies - Agentless scanning

Talos OS

1.6.1

6.1.69-talos

1.26.3

containerd 1.7.11

The following features are not available for Talos OS: - Vulnerability and compliance blocking policies - Agentless scanning

Talos OS

1.6.4

6.1.74-talos

1.26.3

containerd 1.7.13

The following features are not available for Talos OS: - Vulnerability and compliance blocking policies - Agentless scanning

Talos OS

1.6.6

6.1.80-talos

1.26.3

containerd 1.7.13

The following features are not available for Talos OS: - Vulnerability and compliance blocking policies - Agentless scanning

Talos OS

1.6.6

6.1.80-talos

1.29.3

containerd 1.7.13

The following features are not available for Talos OS: - Vulnerability and compliance blocking policies - Agentless scanning

Talos OS

1.7.2

6.6.30-talos

1.29.5

containerd 1.7.16

The following features are not available for Talos OS: - Vulnerability and compliance blocking policies - Agentless scanning

Talos OS

1.7.5

6.6.33-talos

1.29.5

containerd 1.7.18

The following features are not available for Talos OS: - Vulnerability and compliance blocking policies - Agentless scanning

Ubuntu

24.04 LTS

Ubuntu

22.04 LTS

Ubuntu

20.04 LTS

VMWare Photon OS

Runtime scanning supported with kernel version >= 4.19.191-1

The following use features are currently not supported in Photon 3.0: - SSHD application in host runtime events and empty SSH events on Host observations - Vulnerabilities in Layers view

VMWare Photon OS

The following use features are currently not supported in Photon 4.0: - SSHD application in host runtime events and empty SSH events on Host observations - Vulnerabilities in Layers view

VMWare Photon OS

The following use features are currently not supported in Photon 4.0: - SSHD application in host runtime events and empty SSH events on Host observations - Vulnerabilities in Layers view

Windows

Server 2016

Server 2016 Long-Term Servicing Channel (LTSC) support includes only following features: - Vulnerabilty scanning - Compliance scanning - CNNS defense for container - WAAS defense for hosts - Runtime defense for container

Windows

Server 2019

Server 2019 Long-Term Servicing Channel (LTSC) support includes only following features: - Vulnerabilty scanning - Compliance scanning - CNNS defense for container - WAAS defense for hosts - Runtime defense for container

Windows

Server 2022

Server 2022 Long-Term Servicing Channel (LTSC) support includes only following features: - Vulnerabilty scanning - Compliance scanning - CNNS defense for container - WAAS defense for hosts - Runtime defense for container

Supported Operating Systems on ARM64

Prisma Cloud supports host Defenders on the following host operating systems on ARM64 architecture in AWS.

Distro

Version

Kernel

Supported Kubelet

Supported runtime

Notes

Amazon Linux 2

AMI Image: amzn-ami-hvm-2018.03.0.20220315.0-x86_64-gp2 AMI ID: ami-0f7691f59fd7c47af

5.10.96-90.460.amzn2.aarch64

CentOS

Debian

Redhat Enterprise Linux (RHEL)

Ubuntu

Oracle Enterprise Linux (OEL)

Kernel Capabilities

Prisma Cloud Defender requires the following kernel capabilities. Refer to the the Linux capabilities man page for more details on each capability.

CAP_NET_ADMIN
CAP_NET_RAW
`CAP_SYS_ADMIN
CAP_SYS_PTRACE
CAP_SYS_CHROOT
CAP_MKNOD
CAP_SETFCAP
CAP_IPC_LOCK
The Prisma Cloud App-Embedded Defender requires CAP_SYS_PTRACE only.
Embedding defender in an application that is running in a non-privileged mode and that invokes another application/process with sudo, may cause the defender process to panic.

Embedding Defender in an application that is running in a non-privileged mode and that invokes another application/process with sudo, may cause the defender process to panic

When running on a Docker host, Prisma Cloud Defender uses the following files/folder on the host:

/var/run/docker.sock — Required for accessing Docker runtime.
/var/lib/twistlock — Required for storing Prisma Cloud data.
/dev/log — Required for writing to syslog.

Docker Engine

Prisma Cloud supports only the versions of the Docker Engine supported by Docker itself. Prisma Cloud supports only the following official mainstream Docker releases and later versions.

Edition

Version

Community Edition (CE)

24.0.5

Community Edition (CE)

25.0.3

Enterprise Edition (EE)

19.03.4

Enterprise Edition (EE)

19.03.8

The following storage drivers are supported: * overlay2 * overlay * devicemapper

For more information, review Docker’s guide to select a storage driver.

The versions of Docker Engine listed apply to versions you independently install on a host. The versions shipped as a part of an orchestrator, such as Red Hat OpenShift, might defer. Prisma Cloud supports the version of Docker Engine that ships with any Prisma Cloud-supported version of the orchestrator.

Container Runtimes

Prisma Cloud supports several container runtimes depending on the orchestrator. Supported versions are listed in the orchestration section

Podman

Podman is a daemon-less container engine for developing, managing, and running OCI containers on Linux. The twistcli tool can use the preinstalled Podman binary to scan CRI images.

Podman v1.6.4, v3.4.2, v4.0.2 are supported.

Note: Defender installation is not supported on Podman hosts.

Helm

Helm is a package manager for Kubernetes that allows developers and operators to package, configure, and deploy applications and services onto Kubernetes clusters.

Helm v3.10, v3.10.3, and 3.11 are supported.

Orchestrators

Prisma Cloud is supported on the following orchestrators. We support the following versions of official mainline vendor/project releases.

Supported Orchestrators on x86_64

Orchestrator

Version

Operating System

Image

Runtime

Kernel

Tested in

Notes

Azure Kubernetes Service (AKS)

v1.28.3

Linux

containerd://1.7.5-1

Azure Kubernetes Service (AKS)

1.27.3

Linux

containerd://1.7.1+azure-1

Azure Kubernetes Service (AKS)

v1.26.6

Linux

containerd://1.7.1+azure-1

Azure Kubernetes Service (AKS)

v1.25.11

Linux

containerd://1.7.1+azure-1

Azure Kubernetes Service (AKS)

1.27.7

Windows

containerd://1.6.21+azure

Azure Kubernetes Service (AKS)

1.27.3

Linux

containerd://1.7.1+azure-1

32.01

Azure Kubernetes Service (AKS)

v1.26.6

Linux

containerd://1.7.1+azure-1

32.01

Azure Kubernetes Service (AKS)

v1.25.11

Linux

containerd://1.7.1+azure-1

32.01

Azure Kubernetes Service (AKS)

v1.28.3

Windows

containerd://1.7.1

32.01

Azure Kubernetes Service (AKS)

v1.28.3

Linux

containerd://1.7.5-1

32.02

Azure Kubernetes Service (AKS)

1.27.3

Linux

containerd://1.7.1+azure-1

32.02

Azure Kubernetes Service (AKS)

v1.26.6

Linux

containerd://1.7.1+azure-1

32.02

Azure Kubernetes Service (AKS)

v1.25.11

Linux

containerd://1.7.1+azure-1

32.02

Azure Kubernetes Service (AKS)

v1.28.3

Linux

containerd://1.7.5-1

32.02

Azure Kubernetes Service (AKS)

v1.28.3

Windows

containerd://1.7.1

32.02

Azure Kubernetes Service (AKS)

v1.28.3

Linux

containerd://1.7.5-1

32.03

Azure Kubernetes Service (AKS)

1.27.3

Linux

containerd://1.7.1+azure-1

32.03

Azure Kubernetes Service (AKS)

v1.26.6

Linux

containerd://1.7.1+azure-1

32.03

Azure Kubernetes Service (AKS)

v1.25.11

Linux

containerd://1.7.1+azure-1

32.03

Azure Kubernetes Service (AKS)

v1.28.3

Windows

containerd://1.7.1

32.03

Azure Kubernetes Service (AKS)

v1.28.5

Linux

containerd://1.7.1-1

32.04

Azure Kubernetes Service (AKS)

1.27.3

Linux

containerd://1.7.1+azure-1

32.04

Azure Kubernetes Service (AKS)

v1.26.6

Linux

containerd://1.7.1+azure-1

32.04

Azure Kubernetes Service (AKS)

v1.25.11

Linux

containerd://1.7.1+azure-1

32.04

Azure Kubernetes Service (AKS)

v1.29

Windows

containerd://1.7.9

32.04

Azure Kubernetes Service (AKS)

v1.29.2

Windows

containerd://1.7.9

32.05

Azure Kubernetes Service (AKS)

v1.25.11

Linux

containerd://1.7.1+azure-1

32.05

Azure Kubernetes Service (AKS)

v1.27.3

Linux

containerd://1.7.1+azure-1

32.05

Azure Kubernetes Service (AKS)

v1.28.5

Linux

containerd://1.7.7-1

32.05

Azure Kubernetes Service (AKS)

v1.29.2

Linux

containerd://1.7.7-1

32.05

Azure Kubernetes Service (AKS)

v1.27.3

Linux

containerd://1.7.1+azure-1

32.06

Azure Kubernetes Service (AKS)

v1.28.5

Linux

containerd://1.7.7-1

32.06

Azure Kubernetes Service (AKS)

v1.29.2

Linux

containerd://1.7.7-1

32.06

Azure Kubernetes Service (AKS)

v1.29.4

Linux (Mariner)

containerd://1.6.26

32.06

Azure Kubernetes Service (AKS)

v1.27.3

Linux

containerd://1.7.1+azure-1

32.07

Azure Kubernetes Service (AKS)

v1.28.5

Linux

containerd://1.7.7-1

32.07

Azure Kubernetes Service (AKS)

v1.29.2

Linux

containerd://1.7.7-1

32.07

Azure Kubernetes Service (AKS)

v1.29.4

Linux (Mariner)

containerd://1.6.26

32.07

Elastic Container Service (ECS)

1.79.0

al2023-ami-ecs-hvm-2023.0.20231103-kernel-6.1-x86_64

Docker version: 20.10.25

Elastic Container Service (ECS)

1.79.2

al2023-ami-ecs-neuron-hvm-2023.0.20231213-kernel-6.1-x86_64

Docker version: 20.10.25

32.01

Elastic Container Service (ECS)

1.79.2

al2023-ami-ecs-neuron-hvm-2023.0.20231219-kernel-6.1-x86_64

Docker version: 20.10.25

32.02

Elastic Container Service (ECS)

1.81.0

al2023-ami-ecs-neuron-hvm-2023.0.20240207-kernel-6.1-x86_64

Docker version: 20.10.25

32.03

Elastic Container Service (ECS)

1.82.0

al2023-ami-ecs-neuron-hvm-2023.0.20240305-kernel-6.1-x86_64

Docker version: 20.10.25

32.04

Elastic Container Service (ECS)

1.82.2

al2023-ami-ecs-neuron-hvm-2023.0.20240409-kernel-6.1-x86_64

Docker version: 25.0.3

32.05

Elastic Container Service (ECS)

1.82.3

al2023-ami-ecs-neuron-hvm-2023.0.20240409-kernel-6.1-x86_64

Docker version: 25.0.3

32.06

Elastic Container Service (ECS)

1.84.0

al2023-ami-ecs-hvm-2023.0.20240625-kernel-6.1-x86_64

Docker version: 25.0.3

32.07