Skip to content
SPECIFICTION
Get listed

Tetragon

tetragon.io

Free plan LinuxAPISelf-hosted
Visit tetragon.io
Spec score 7.9 #6 of 23 in Cloud Workload Protection Platforms

What it is

Tetragon is a Kubernetes-aware security observability and runtime enforcement tool for Linux, container, and Kubernetes workloads. It uses eBPF to monitor activity, filter events, and enforce policies in the kernel in real time. Process reports can include executed binaries, command-line arguments, user IDs, parent processes, and start times. Tetragon also monitors file access and changes, and can block unauthorized file operations at the kernel level. Kubernetes policies can filter activity by namespace, pod labels, and container fields, with support for containerd and CRI-O. Network visibility ties events to processes and workloads and tracks connections, socket lifecycle, and bytes sent or received. The tool also monitors credential changes, kernel module activity, and eBPF program loads and interactions. Findings are available as JSON logs or through gRPC. Installation options include Helm on Kubernetes, released Linux packages, and a container image. Tetragon is a Cilium sub-project and a CNCF project, and is available as an open-source project with no paid plans listed.

Spec sheet

Purpose
Tetragon is a Kubernetes-aware security observability and runtime enforcement tool that applies policy and filtering with eBPF.Read 7 Oct 2026 · tetragon.io
Integrations
The official site documents Kubernetes installation via Helm and container deployment using an image from the Tetragon Quay repository.Read 7 Oct 2026 · tetragon.io
Support
The site links users to documentation, GitHub, and the Cilium Slack community.Read 7 Oct 2026 · tetragon.io
Event interfaces
Tetragon shares insights through JSON logs and a gRPC endpoint.Read 7 Oct 2026 · tetragon.io
File monitoring
Tetragon monitors file access and modifications and can block unauthorized file operations at the kernel level.Read 7 Oct 2026 · tetragon.io
Host integrity
It monitors kernel module loading and unloading and eBPF program loads and interactions.Read 7 Oct 2026 · tetragon.io
Installation
The maker documents installation on Kubernetes via Helm, on Linux via released packages, and as a container image.Read 7 Oct 2026 · tetragon.io
Intended workloads
The maker says Tetragon was built for Linux, container, and Kubernetes workloads.Read 7 Oct 2026 · tetragon.io
Kernel enforcement
Tetragon can monitor, filter, and enforce policies in the kernel in real time.Read 7 Oct 2026 · tetragon.io
Kubernetes policies
Policies can filter by Kubernetes namespaces, pod labels, and container fields; the feature page says Tetragon supports containerd and CRI-O.Read 7 Oct 2026 · tetragon.io
Network observability
Tetragon links network events to processes and workloads and tracks socket lifecycle events, connections, and bytes sent or received.Read 7 Oct 2026 · tetragon.io
Operating system integrity
Tetragon monitors kernel module loading and unloading and eBPF program loads and interactions.Read 7 Oct 2026 · tetragon.io
Output interfaces
Tetragon shares insights through JSON logs and a gRPC endpoint.Read 7 Oct 2026 · tetragon.io
Policy library
The policy library provides documented policy examples paired with use cases, while community examples are not curated for suitability or best practices.Read 7 Oct 2026 · tetragon.io
Privilege monitoring
It records Linux capability checks with the requested capability, process identity, and whether access was granted or denied.Read 7 Oct 2026 · tetragon.io
Process monitoring
Execution monitoring reports details including executed binaries, command-line arguments, user IDs, parent processes, and start times.Read 7 Oct 2026 · tetragon.io
Project affiliation
Tetragon is a sub-project under Cilium and a CNCF project.Read 7 Oct 2026 · tetragon.io
Real-time enforcement
It performs synchronous monitoring, filtering, and enforcement in the kernel using eBPF.Read 7 Oct 2026 · tetragon.io
Security controls
The gRPC TCP listener supports TLS and mutual TLS; the documentation warns that exposing TCP without TLS client verification can let network users modify configuration.Read 7 Oct 2026 · tetragon.io
Security limitation
The threat model says a root-level host attacker can disable or manipulate the local agent and its monitoring data.Read 7 Oct 2026 · tetragon.io
Who it is for
The feature pages describe security teams monitoring Kubernetes workloads, process behavior, privileges, files, and network activity.Read 7 Oct 2026 · tetragon.io

Plans and prices

Tetragon Free No paid plans or price listed on the official site; available as an open-source project with Kubernetes, Linux, and container installation options Read 7 Oct 2026 · tetragon.io

Every Tetragon plan and price →

Strong points and limits

Strong points

  • Real-time kernel monitoring and policy enforcement
  • Tracks process, file, network, and privilege activity
  • Install via Helm, Linux packages, or container image
  • Open-source project with no paid plans listed

Limits

  • A root-level host attacker can manipulate the agent
  • Community policy examples are not curated
  • Exposing gRPC TCP without client verification risks configuration changes

Who it suits

Tetragon is aimed at security teams monitoring Kubernetes workloads, process behavior, privileges, files, and network activity. It is for teams prepared to deploy and operate a Linux-focused tool themselves.

Verdict

Tetragon covers runtime monitoring and enforcement across process, file, network, and Kubernetes activity. Teams should weigh its self-hosted Linux focus and secure the gRPC TCP listener carefully.

Where Specifiction places it

Alternatives to TetragonAll alternatives →