Kerno

Spec sheet

Purpose

Kerno is an eBPF-based incident diagnosis engine for production issues across Linux, Kubernetes, VMs, and bare metal.Read 8 Oct 2026 · github.com

Deployment

Kerno can run as a Kubernetes DaemonSet or as a binary on bare metal, VMs, EC2, and GCE; Docker images are published for Linux amd64 and arm64.Read 8 Oct 2026 · github.com

Integrations

The project lists Prometheus metrics and ServiceMonitor support, Kubernetes pod enrichment, optional Anthropic, OpenAI, and Ollama providers, and systemd enrichment.Read 8 Oct 2026 · github.com

Security

The project says Kerno makes no outbound network calls by default and that AI integration is opt-in through the configured provider.Read 8 Oct 2026 · github.com

Support

The security policy directs general questions to GitHub Discussions and vulnerability reports to [email protected], with acknowledgment targeted within 48 hours.Read 8 Oct 2026 · github.com

License

The repository identifies Kerno as licensed under Apache License 2.0.Read 8 Oct 2026 · github.com

Diagnosis rules

The engine evaluates 11 deterministic rules covering issues such as disk I/O bottlenecks, OOM events, TCP retransmits, scheduler contention, and file descriptor leaks.Read 8 Oct 2026 · github.com

Incident reports

The `kerno doctor` command collects 30 seconds of kernel data and returns ranked findings with causes, evidence, ETAs, and suggested fixes.Read 8 Oct 2026 · github.com

Kernel requirement

The quick start requires Linux kernel 5.8 or later with BTF; Helm or raw manifest deployment requires cluster-admin.Read 8 Oct 2026 · github.com

Monitoring

Its watch commands cover TCP connections and retransmits, OOM kills, and file descriptor leak detection.Read 8 Oct 2026 · github.com

Network policy limitation

The README cautions that standard Kubernetes NetworkPolicy resources generally do not restrict Kerno because it uses host networking, unless host-firewall configuration is used.Read 8 Oct 2026 · github.com

Permissions

The documented Kubernetes security posture lists CAP_BPF, CAP_PERFMON, CAP_SYS_PTRACE, CAP_NET_ADMIN, and CAP_DAC_READ_SEARCH, and says the hot path does not require CAP_SYS_ADMIN.Read 8 Oct 2026 · github.com

Privilege requirement

Kerno needs elevated privileges or documented Linux capabilities to load eBPF programs into the kernel.Read 8 Oct 2026 · github.com

Requirements

Kubernetes use requires Linux kernel 5.8 or later with BTF, and raw manifests or Helm installation require cluster-admin access.Read 8 Oct 2026 · github.com

Roadmap limits

The roadmap lists OpenTelemetry export and Grafana dashboards for v0.2, Slack and PagerDuty integrations for v0.3, and a managed Optiqor Cloud offering for v1.0.Read 8 Oct 2026 · github.com

Security details

The security policy says Kerno's eBPF programs are read-only observers and that it does not log file contents, environment variables, authentication tokens, or network payloads.Read 8 Oct 2026 · github.com

Security posture

The README says Kerno makes no outbound network calls by default and that AI integration is opt-in through a configured provider.Read 8 Oct 2026 · github.com

Tracing

Kerno supports syscall latency, disk I/O latency, and CPU scheduler delay tracing.Read 8 Oct 2026 · github.com

Where Specifiction places it

• eBPF Observability Tools#25 of 297.0