Inspektor Gadget

Inspektor Gadget is an open-source toolkit and framework for eBPF-based inspection across Linux hosts and Kubernetes clusters. It fits platform, security, and observability engineers who want kernel-level signals tied to workloads and containers, rather than a packaged dashboard. The zero-cost, self-hosted model is compelling for technical teams, provided their kernels and Kubernetes environment meet its requirements.

Overview

Inspektor Gadget turns eBPF programs into deployable “gadgets” packaged as OCI images. On Kubernetes, it runs as a DaemonSet with one pod per node, giving node-wide collection a predictable deployment pattern. The project is a CNCF Sandbox project and is designed to feed existing observability systems as well as support direct inspection.

Its practical distinction is context. Kernel events can be enriched with Kubernetes information such as pod and container names, making low-level activity easier to associate with the workloads responsible. That is particularly useful when investigating cluster behavior, network activity, or application performance and a raw kernel trace would otherwise require manual correlation.

Key features

Network visibility, application tracing, and kernel profiling cover the main investigative layers, while data export lets collected information flow into observability tools. Inspektor Gadget is therefore a strong instrumentation component, but it is not presented as a complete monitoring suite with its own broad management experience.

Extensibility is a first-class feature. WebAssembly modules can post-process data and customize operators, and a Go library allows teams to build integrations around the framework. These capabilities reward engineering investment and make the project adaptable; teams wanting an immediately fixed workflow may find that flexibility adds responsibility rather than convenience.

Security controls are unusually concrete for a tool that executes packaged programs. Official image-based gadgets are signed with cosign, documentation describes signature verification, and the --allowed-gadgets flag can restrict execution by digest, tag, or image prefix. Those controls help establish an approval boundary for what operators may run, although they still require administrators to define and maintain policy.

Pricing

Inspektor Gadget costs nothing. The plan is open-source tools and a framework, with self-hosted deployment rather than a hosted service. There are no paid tiers, seat charges, usage quotas, or trial terms stated for this plan, so budget planning is straightforward. The trade-off is operational ownership: deployment, upgrades, policy, and observability integrations remain with your team.

Platforms

Project gadgets require Linux kernel 5.10 or later with BTF enabled. That prerequisite is decisive: older kernels or systems without BTF are not suitable for the project’s gadgets. Supported Kubernetes environments include Minikube, AKS, EKS, GKS, OpenShift, and Talos. AWS Fargate, Azure Container Instances, and GKE Autopilot are unsupported, ruling out several managed-container approaches.

The framework targets Linux, while macOS and Windows are supported as client platforms through gadgetctl. The overall deployment model remains self-hosted, with API access alongside Linux, macOS, and Windows client availability.

Who it's for

Choose Inspektor Gadget when your team operates Kubernetes or Linux infrastructure, can satisfy the kernel requirements, and wants programmable eBPF inspection with Kubernetes-aware context. It is especially well suited to platform and observability engineers who already have downstream tools and want richer node and workload signals.

Look elsewhere if you need a hosted experience, support for Fargate or GKE Autopilot, or a long-term maintenance branch. Only the latest release receives security updates and maintenance, so adopting it means keeping upgrades in your operational cycle.

Pros and cons

• Pros: OCI-packaged gadgets simplify distribution of eBPF programs; Kubernetes enrichment connects kernel data to pods and containers; WebAssembly and Go support substantial customization; cosign verification and gadget allow-lists provide useful execution controls; the open-source price removes licensing cost.
• Cons: Linux 5.10+ with BTF is mandatory for project gadgets; several container platforms are unsupported; self-hosting leaves deployment and integration work to your team; latest-release-only maintenance increases upgrade pressure.

Alternatives

For a wider comparison of this category, see eBPF Observability Tools.

Kubeshark is a better fit when you want freemium packaging and a Community plan capped at three nodes or 60 pods, with web access and broad client platforms. DeepFlow suits buyers seeking a free open-source edition spanning Linux servers and selected Kubernetes, cloud, and container environments.

Qpoint is aimed at endpoint discovery and monitoring, with a Community allowance of 25 endpoints and policy plugins. Coroot is preferable when you want a self-hosted Apache 2.0 community edition focused on core observability features.

Odigos centers on OpenTelemetry tracing and offers an open-source Apache 2.0 plan. bpftrace is the leaner choice for Linux-only tracing with a compatible kernel and BPF support. Caretta is another open-source Kubernetes option. Grafana k6 is better when the goal is load testing, with its Free plan limited to 500 virtual user hours per month.

Verdict

Inspektor Gadget is a strong choice for technically capable Kubernetes and Linux teams that want extensible eBPF inspection enriched with workload context at no license cost. Choose it for programmable, self-hosted visibility and governed gadget execution; look elsewhere if your platform is unsupported or you need hosted operations and maintenance beyond the latest release.