runtime security

Tetragon

Tetragon is an eBPF-based security observability tool from the Cilium project. This profile covers what it does, how it is deployed, and where it stops being the right choice.

What the product actually does

Tetragon attaches eBPF programs to kernel functions and traces process execution, network connections and file access with full Kubernetes context — which pod, which namespace, which container image. The tracing is kernel-side, so it cannot be bypassed from inside the container.

The difference from a pure detection tool is enforcement. Tetragon can block a syscall or kill a process based on a policy, which turns an alert into a control.

How it is deployed and what it costs

Open source and free, deployed as a daemonset. The requirement is a kernel new enough for the eBPF features used, which excludes some older distributions.

The cost is the same as any runtime agent: node resources and the operational work of writing and tuning policies.

Where it breaks down

Policy authoring is a lower-level exercise than rule writing in a higher-level tool. The tracing policies are expressed against kernel functions, which requires understanding what the kernel actually calls.

Enforcement carries risk. A policy that kills a process in the wrong conditions takes down a workload, and the blast radius of a mistake is production.

What switching costs

Moderate. The eBPF programs and tracing policies are Tetragon's own, and a replacement has a different policy language.

Sources

Tetragon public documentation, read October 2026.