Tetragon
Tetragon is a security observability and runtime enforcement tool for Linux, containers, and Kubernetes workloads.
What Tetragon is
Tetragon is a security observability and runtime enforcement tool for Linux, containers, and Kubernetes workloads. Using eBPF, it can monitor activity, filter events, and enforce policies in the kernel in real time. Process monitoring can report executed binaries, command-line arguments, user IDs, parent processes, and start times. It tracks file access and changes, and can block unauthorized file operations. Kubernetes policies can filter by namespace, pod labels, and container fields, with support for containerd and CRI-O. Network observability links events to processes and workloads, tracking socket lifecycle, connections, and bytes sent or received. Tetragon also monitors credential changes, kernel module activity, and eBPF program loads and interactions. Findings are available as JSON logs or through a gRPC endpoint. It is free, with installation options including Helm on Kubernetes, Linux packages, and a container image. Tetragon is a Cilium sub-project and a CNCF project.
Good
- Enforces policies in the kernel in real time
- Can block unauthorized file operations
- Links network events to processes and workloads
- Offers Kubernetes, Linux, and container installation options
Watch out
- A root-level host attacker can disable or manipulate the agent
- Community policy examples are not curated for suitability
- Exposing gRPC TCP without client verification can permit configuration changes
Who it suits
Tetragon suits security teams monitoring Kubernetes and Linux workloads, including process, file, privilege, and network activity. It is intended for Linux, container, and Kubernetes environments.
Verdict
Tetragon provides kernel-level monitoring and enforcement across process, file, network, and Kubernetes activity. Teams should account for its host-root threat limitation and carefully configure the gRPC TCP listener.
Plans and prices
From Tetragon's own pricing page, checked 7 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Tetragon | Free | No paid plans or price listed on the official site; available as an open-source project with Kubernetes, Linux, and container installation options |
The facts
Each one read from Tetragon's own pages, with the date it was checked.
What it does
- Event interfaces
- Tetragon shares insights through JSON logs and a gRPC endpoint.checked 7 Oct 2026
- File monitoring
- Tetragon monitors file access and modifications and can block unauthorized file operations at the kernel level.checked 7 Oct 2026
- Host integrity
- It monitors kernel module loading and unloading and eBPF program loads and interactions.checked 7 Oct 2026
- Installation
- The maker documents installation on Kubernetes via Helm, on Linux via released packages, and as a container image.checked 7 Oct 2026
- Integrations
- The official site documents Kubernetes installation via Helm and container deployment using an image from the Tetragon Quay repository.checked 7 Oct 2026
- Intended workloads
- The maker says Tetragon was built for Linux, container, and Kubernetes workloads.checked 7 Oct 2026
- Kernel enforcement
- Tetragon can monitor, filter, and enforce policies in the kernel in real time.checked 7 Oct 2026
- Kubernetes policies
- Policies can filter by Kubernetes namespaces, pod labels, and container fields; the feature page says Tetragon supports containerd and CRI-O.checked 7 Oct 2026
- Network observability
- Tetragon links network events to processes and workloads and tracks socket lifecycle events, connections, and bytes sent or received.checked 7 Oct 2026
- Operating system integrity
- Tetragon monitors kernel module loading and unloading and eBPF program loads and interactions.checked 7 Oct 2026
- Output interfaces
- Tetragon shares insights through JSON logs and a gRPC endpoint.checked 7 Oct 2026
- Policy library
- The policy library provides documented policy examples paired with use cases, while community examples are not curated for suitability or best practices.checked 7 Oct 2026
- Privilege monitoring
- Tetragon monitors process credential changes, including user IDs, group IDs, and capabilities, at system-call and kernel levels.checked 7 Oct 2026
- Process monitoring
- Execution monitoring reports details including executed binaries, command-line arguments, user IDs, parent processes, and start times.checked 7 Oct 2026
- Project affiliation
- Tetragon is a sub-project under Cilium and a CNCF project.checked 7 Oct 2026
- Purpose
- Tetragon is a Kubernetes-aware security observability and runtime enforcement tool that applies policy and filtering with eBPF.checked 7 Oct 2026
- Real-time enforcement
- It performs synchronous monitoring, filtering, and enforcement in the kernel using eBPF.checked 7 Oct 2026
- Security controls
- The gRPC TCP listener supports TLS and mutual TLS; the documentation warns that exposing TCP without TLS client verification can let network users modify configuration.checked 7 Oct 2026
- Security limitation
- The threat model says a root-level host attacker can disable or manipulate the local agent and its monitoring data.checked 7 Oct 2026
- Support
- The site links users to documentation, GitHub, and the Cilium Slack community.checked 7 Oct 2026
- Who it is for
- The feature pages describe security teams monitoring Kubernetes workloads, process behavior, privileges, files, and network activity.checked 7 Oct 2026
Alternatives to Tetragon
- 1
Amazon GuardDuty
Free planWebAPILinux7.6From $0.03 a month - 2
Calico Cloud
Free planWebAPILinuxSelf-hosted7.6Free plan - 3
Sysdig Secure
WebAPILinuxmacOS7.2From $20 a month - 4
Qualys TotalCloud
Free planWebAPI7.0Free plan - 5
SentinelOne Singularity Cloud Security
AndroidiOSWebAPI6.9 - 6
KubeArmor
Free planAPILinuxSelf-hosted6.5Free plan