+++ title = "Tetragon - eBPF-based Security Observability and Runtime Enforcement" linkTitle = "Tetragon - eBPF-based Security Observability and Runtime Enforcement" +++
Tetragon is a sub-project under Cillium and a proud CNCF project

# eBPF-based Security Observability and Runtime Enforcement

Tetragon is a flexible Kubernetes-aware security observability and runtime enforcement tool that applies policy and filtering directly with eBPF, allowing for reduced observation overhead, tracking of any process, and real-time enforcement of policies.

Try Tetragon Watch video

## Tech leaders use Tetragon

## Why Tetragon?

- ### Minimal Overhead

  eBPF enables deep observability with low performance overhead mitigating risks without the latency introduced by user-space processing.

- ### Kubernetes-Aware

  Tetragon extends Cilium's design by recognizing workload identities like namespace and pod metadata, surpassing traditional observability.

- ### Simplified Operation

  Tetragon offers pre-defined policy libraries for rapid deployment and operational insight, reducing setup time and complexity at scale.

- ### Kernel-level enforcement

  Tetragon blocks malicious activities at the kernel level, closing the window for exploitation without succumbing to TOCTOU attack vectors.

- ### Real-time Policy Engine

  Synchronous monitoring, filtering, and enforcement are performed entirely within the kernel using eBPF.

- ### Advanced Application Insights

  Tetragon goes beyond traditional monitoring, capturing events like process execution, network communications, and file access.

## What can Tetragon do?

Cilium Tetragon is a flexible Kubernetes-aware security observability and runtime

Read the documentation

- Controlling binary execution (e.g. disallow binary execution from /tmp or allow binaries to be executed)
- Detect Linux Namespace & Privilege Changes
- Kubernetes Data Exfiltration
- File Integrity Monitoring
- And more!

Read the documentation

## How does Tetragon work?

Tetragon monitors processes, syscalls, file and network activity in the kernel, correlating threats with network data to identify responsible binaries. It shares insights via JSON logs and a gRPC endpoint.

- ### Tetragon Policy Library

  Catalog of vetted Tetragon policies for various use cases, implementing observability and runtime enforcement mechanisms.

  Read more

- ### Code of Conduct

  To make Tetragon a welcoming and harassment-free experience for everyone, we follow the Cilium Code of Conduct.

  Read more

## How to Install Tetragon?

- Install Tetragon on Kubernetes Download via helm chart
  {{< tab-code header="Kubernetes" lang="shell" >}} helm repo add cilium https://helm.cilium.io helm repo update helm install tetragon cilium/tetragon -n kube-system kubectl rollout status -n kube-system ds/tetragon -w {{< /tab-code >}}
  Install on any Linux system Install and manage Tetragon via released packages
  {{< tab-code header="Linux" lang="shell" >}} curl -LO https://github.com/cilium/tetragon/releases/download/{{< latest-version >}}/tetragon-{{< latest-version >}}-amd64.tar.gz tar -xvf tetragon-{{< latest-version >}}-amd64.tar.gz cd tetragon-{{< latest-version >}}-amd64/ sudo ./install.sh sudo systemctl status tetragon {{< /tab-code >}}
  Deploy as a container Run the Tetragon image from the Tetragon quay repository
  {{< tab-code header="Container" lang="shell" >}} docker run --name tetragon --rm -d --pid=host --cgroupns=host --privileged -v /sys/kernel/btf/vmlinux:/var/lib/tetragon/btf quay.io/cilium/tetragon:{{< latest-version >}} {{< /tab-code >}}
- Read the documentation Watch tutorial

## Exciting Updates and Announcements

Highlights Innovations in Modern Security Approaches

- User Story

### Why This Social Networking Company Made Tetragon a Default for their Kubernetes Clusters

15 April, 2025

- - Tutorial
  - Community

  ### Tetragon Detects io_uring File Access

  25 Dec, 2025
- - Conference
  - External

  ### Tetragon related talks at Kubecon EU 2025

  21 Feb, 2025
- - Article
  - External

  ### Tetragon: 2024 in Review

  31 Dec, 2024
- - eCHO episode
  - External

  ### eCHO Episode 134: Tetragon in Action

  03 May, 2024
- - Tutorial
  - External

  ### Restrict Access to Secure Files with Tetragon | eBPF Runtime Enforcement

  22 Feb, 2024
- - Tutorial
  - External

  ### eBPF for Runtime Enforcement | Tetragon Introduction and Overview

  21 Feb, 2024
- - Article
  - Community

  ### Tetragon community Call

  20 Feb, 2024
- - Conference Talk
  - External

  ### Coping with Zero Days with Cilium Tetragon

  17 Sep, 2024

## Get hands-on with Tetragon

Practice using Tetragon labs to detect and respond to system activity events, such as process executions, file access, network I/O

- ### Tetragon Lab

  Try out the Introduction to Tetragon lab

  Try now

- ### Exploring Tetragon Lab

  A Security Observability Tool for Kubernetes, Docker, and Linux

  Try now

## Watch videos on Tetragon Show all videos

- ### The Next Log4jshell?! Preparing for CVEs with eBPF!

  John Fastabend & Natalia Reka Ivanko • May 1, 2023

- ### Tutorial: Getting Familiar with Security Observability Using eBPF & Cilium Tetragon

  Duffie Cooley & Raphaël Pinson • Apr 30, 2023

- ### Securing the Superpowers: Who Loaded That EBPF Program?

  John Fastabend & Natalia Reka Ivanko • Feb 3, 2023

Show all videos

## Security Bugs

We strongly encourage you to report security vulnerabilities to our private security mailing list: security@cilium.io - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium security team are subscribed to, and is treated as top priority.

Report a bug

## Event in a box

All you need for a successful Tetragon talk. Are you passionate about Tetragon and want to share your experience with the broader community? We want to help you tell your story! Whether writing a blog post, creating a YouTube or Twitch video, or speaking at a conference, we will help you deliver your Tetragon story to a broad audience.

Request event help
{{< social >}}

- ## What is a Tracing Policy?

  Tracing Policies define what situations Tetragon should react to...

  - 1
  - 2
  - 3

- ## Showcase Tetragon: Slides for Speakers

  We've created a slide deck for talks, presentations, and demos on Tetragon. Feel free to use it as-is or customize it to fit your specific needs.

  See presentation

## Telling the Tetragon Story

Creating an abstract, putting a presentation together, or writing a blog post doesn’t come naturally to everyone. If you are eager to tell your Cilium story and need help, we’re here for you.

Not a native speaker and/or not confident about your writing skills? No worries. Bring the story and we’ll help you tell it in an engaging way.

Name Email Cilium Slack Username How are you using Tetragon? Message

What do you need help with?

- Reviewing an abstract
- Polish a presentation
- Finding a speaker for an event or livestream
- Getting a Retweet

- Writing a blog post
- Writing a case study
- Submitting to eCHO News
- Other