Open-source alternatives to Sysdig

Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments. It functions as a security policy manager, observability agent, and enforcement engine that hooks into kernel functions and tracepoints to detect privilege escalation, container escapes, and unauthorized system activity. The project distinguishes itself through its ability to perform real-time, in-kernel enforcement, allowing it to synchronously terminate malicious processes or modify function return values before a system call completes. It provides deep Kubernetes integration

Inspektor Gadget is an eBPF observability toolset and program framework designed for tracing Linux systems and debugging Kubernetes nodes. It provides a suite of tools to collect kernel-level telemetry and export system metrics via the OpenTelemetry standard. The project distinguishes itself by packaging inspection tools as OCI-compliant container images, allowing for standardized distribution and deployment across clusters and hosts. It employs a modular data processing pipeline that utilizes WebAssembly modules to transform and filter telemetry, and leverages Compile Once Run Everywhere for

Glances is a cross-platform system monitoring tool designed to track real-time resource usage and hardware health metrics across diverse computing environments. It functions as a command-line utility that provides a unified view of system performance, identifying bottlenecks and maintaining infrastructure stability through a consistent abstraction layer that translates kernel calls into actionable data. The project distinguishes itself through its distributed capabilities, offering a web-based interface that enables remote access to live performance metrics from any device without requiring d

MTR is a network diagnostic tool that combines the functions of traceroute and ping to monitor packet loss and latency across every hop in a network path. It serves as an ICMP route analyzer and packet loss monitor designed to discover network paths and measure the performance of intervening routers. The tool functions as a network path visualizer, displaying real-time network health and connectivity data through either a text-based terminal interface or a graphical window. The project covers network path mapping and real-time path tracing to identify routers between a host and destination.

BCC is an eBPF development toolkit and tracing framework used for monitoring and analyzing the Linux kernel. It functions as a performance analysis tool and debugging utility to capture system events, measure kernel latency, and provide network observability. The project distinguishes itself by providing a build system that integrates with LLVM to compile C-like code into BPF bytecode at runtime. It utilizes BPF Type Format data for relocations to maintain cross-kernel compatibility and extracts kernel headers to ensure the generated programs match the specific kernel version. The toolkit co

Perfetto is a platform for system-level performance tracing and analysis on Linux and Android. It combines a high-throughput trace recorder, a SQL-based query engine, and a browser-based visualizer into a single toolchain. The platform covers CPU scheduling and call-stack profiling, native and Java heap memory allocation tracking, GPU and graphics events, and system-wide counters such as CPU frequency and power consumption. The architecture decouples trace recording from offline analysis, using a compact protobuf format for event encoding and columnar storage for efficient SQL queries. The we

bpftrace is a high-level eBPF tracing tool and kernel instrumentation framework for Linux. It provides a tracing language to instrument kernel and user-space events without recompiling the system, functioning as a dynamic system profiler and event aggregator. The project enables dynamic system tracing and Linux kernel observability by capturing tracepoints and dynamic probes in real time. It allows for kernel data inspection and runtime process debugging by accessing internal data structures and filtering specific process events. Its capability surface covers system performance analysis, inc

This project is a comprehensive, community-driven directory that serves as a centralized discovery hub for the container ecosystem. It functions as a structured knowledge base, aggregating a wide array of software tools, educational materials, and technical resources designed to assist developers and operators in mastering containerization technologies. The repository distinguishes itself through a meticulously organized taxonomy that maps the entire container lifecycle, from initial development and image building to orchestration, security, and infrastructure operations. By curating disparat

Wazuh is an integrated security platform that combines endpoint detection and response, security information and event management, and cloud workload protection. It functions as a centralized system for collecting telemetry, aggregating logs, and correlating events across distributed infrastructure to maintain security and integrity. The platform distinguishes itself through its active response orchestration, which allows for the automated execution of scripts on remote endpoints to neutralize threats in real time. It provides deep visibility into system activity through file integrity monito

This project is a framework for composing terminal interfaces through declarative styling and a grid-based layout engine. It provides a comprehensive toolkit for building responsive command-line applications by managing ANSI escape sequences, color profiles, and text rendering to ensure consistent visual output across different terminal environments. The library distinguishes itself through its ability to automatically detect terminal capabilities and background themes, allowing it to adjust color schemes and downsample profiles for optimal readability. It utilizes a layered composition model

tcell is a Go terminal user interface library and framework for building cell-based applications. It functions as a terminal emulator backend and input processor, utilizing a change-based diffing engine to manage screen state and efficiently render updates. The project is distinguished by its pluggable backend abstraction, which allows terminal interfaces to be rendered across physical terminals or compiled into WebAssembly for web browser display. It provides a virtual screen simulation to enable programmatic event injection and output inspection for automated application testing. Its capab

tview is a library for building interactive text-based user interfaces in Go. It functions as a toolkit for managing event loops, user input, and screen rendering, providing a framework of pre-built widgets and an integrated layout engine for creating command-line applications. The project distinguishes itself through a comprehensive layout system that uses grid and flexbox models to create responsive designs. It also supports UI layer stacking to manage multiple screens and modal overlays. The framework includes a diverse suite of interactive components for data display, such as tables and

Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o

Clack is a Node.js CLI framework and prompt library designed for building stylized, interactive command-line user interfaces. It provides a toolkit for creating terminal applications that collect structured user input and display formatted information. The library includes a set of interactive terminal UI components, such as validated input fields for text and passwords, searchable selection menus with autocomplete, and grouped options for user choice. It also provides mechanisms for process visualization, including loading spinners, progress bars, and sequential task lists to communicate bac

This project is a general-purpose command-line filter that provides an interactive interface for processing standard input streams. It enables real-time fuzzy searching, data selection, and transformation, allowing users to navigate complex information or file systems directly within their terminal. By utilizing a pipe-oriented architecture, it integrates into existing shell pipelines and workflows to facilitate efficient data exploration. What distinguishes this tool is its highly extensible, event-driven design that allows for deep integration with external processes. It supports asynchrono

Ranger is a keyboard-centric console file manager that provides a multi-column, text-based interface for navigating and organizing local file systems. It functions as a productivity tool designed to streamline command-line workflows by allowing users to perform standard file operations, such as copying, moving, and deleting, directly within a terminal environment. The project distinguishes itself through its extensible architecture and deep integration with the host shell. It supports custom plugin development and maintains context between sessions by syncing the working directory upon exit.

This project is a terminal-based dashboard for managing Kubernetes clusters. It provides a character-based interface that enables real-time monitoring and interactive control of containerized workloads, allowing users to perform administrative tasks such as scaling deployments, viewing logs, and managing port forwarding directly from the command line. The interface is designed for high-speed navigation, utilizing a keyboard-driven command system that maps input sequences to specific operational actions. It maintains an accurate view of the cluster state through asynchronous event polling, ens

Browsh is a text-based web browser and headless browser frontend that renders modern websites and web applications within a terminal emulator. It functions as a TTY web browser, allowing users to view and interact with complex web content directly from a command line interface. The project enables web navigation in environments where a graphical user interface is unavailable, such as when accessing a remote server via SSH or operating in low-bandwidth conditions. It translates browser pixels and colors into ANSI escape codes to simulate a graphical interface using text characters. The system

nvtop is a terminal-based dashboard used for monitoring the performance, memory usage, and temperature of multiple graphics processors and hardware accelerators. It functions as a centralized administration tool to track the health and compute load of several devices across a single system. The tool distinguishes itself by correlating system process IDs with hardware resource consumption, allowing users to identify specific applications consuming GPU resources. It employs a vendor-agnostic abstraction layer to support hardware from multiple different manufacturers within a single interface.

ai-shell is an AI-powered terminal assistant and natural language interface for the command line. It functions as a shell command generator that translates plain text instructions into executable machine-readable shell syntax using large language models. The tool provides a conversational interface for technical support and shell command discovery, allowing users to find correct flags and arguments through multi-turn dialogues. It streamlines terminal workflows by converting natural language descriptions into executable scripts accompanied by human-readable explanations. The system includes

Termui is a Go terminal user interface library used for building interactive dashboards and visual layouts within a command-line environment. It functions as a TUI layout engine, an interactive CLI framework, and a terminal data visualization toolkit. The library provides a set of specialized widgets for rendering charts, plots, gauges, and tables using character-based graphics. It includes a grid-based system for arranging interface elements using relative coordinates and proportional sizing to create structured displays. The toolkit covers a broad range of capabilities including data visua

Slides is a command-line utility that renders markdown files into interactive presentations displayed directly within a terminal environment. It functions as a terminal user interface, providing a system for navigating content through keyboard-driven controls and managing slide transitions. The tool incorporates a presentation theme engine that allows for the definition and application of custom visual styles and color schemes. By using structured metadata embedded within the markdown source, users can maintain consistent branding and layout properties across their slide decks. This utility

Btop is a terminal-based system monitor that tracks and displays real-time hardware performance metrics. It functions as a resource usage dashboard, providing visibility into processor, memory, disk, network, and active process activity directly within a text-based interface. The application utilizes ANSI escape sequences to render complex graphical interfaces and data visualizations within standard terminal emulators. It is designed as a cross-platform performance tool, maintaining consistent monitoring capabilities across various Unix-like operating systems through a platform-agnostic build

This project is a modular, terminal-based dashboard framework designed to aggregate and display real-time information within a grid-aligned interface. It functions as a centralized monitoring tool that translates data from local system resources, infrastructure services, and external web APIs into a unified, text-based display. The dashboard is distinguished by its plugin-based architecture, which allows users to encapsulate distinct data sources and display logic into isolated, independently managed modules. Users define their workspace through declarative configuration files or an interacti

Micro is a terminal-based text editor designed for use within command-line interfaces. It provides a keyboard-centric environment for creating and modifying source code and configuration files without requiring a graphical desktop system. The editor features a modular architecture centered on a plugin-driven system and an embedded scripting engine. Users can extend core functionality, automate workflows, and customize editor behavior by writing scripts or installing external extensions through a centralized package management system. This extensibility allows for the integration of custom com

This project is a comprehensive educational resource and curriculum focused on site reliability engineering, distributed systems, and infrastructure operations. It provides technical guides, a systems engineering course, and instructional manuals designed to teach the principles of managing large-scale computing environments. The curriculum covers high-level architectural design for scalability and resilience, including fault-tolerant infrastructure, high-availability patterns, and microservices decomposition. It emphasizes the practical application of site reliability engineering through the