# inspektor-gadget/inspektor-gadget **Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/inspektor-gadget-inspektor-gadget).** 2,720 stars · 325 forks · C · apache-2.0 ## Links - GitHub: https://github.com/inspektor-gadget/inspektor-gadget - Homepage: https://www.inspektor-gadget.io - awesome-repositories: https://awesome-repositories.com/repository/inspektor-gadget-inspektor-gadget.md ## Topics `bpf` `bpf-programs` `cncf-project` `ebpf` `ebpf-programs` `inspektor-gadget` `kinvolk` `kubernetes` `prometheus-exporter` `prometheus-metrics` ## Description Inspektor Gadget is an eBPF observability toolset and program framework designed for tracing Linux systems and debugging Kubernetes nodes. It provides a suite of tools to collect kernel-level telemetry and export system metrics via the OpenTelemetry standard. The project distinguishes itself by packaging inspection tools as OCI-compliant container images, allowing for standardized distribution and deployment across clusters and hosts. It employs a modular data processing pipeline that utilizes WebAssembly modules to transform and filter telemetry, and leverages Compile Once Run Everywhere for kernel portability. The framework covers a broad range of capabilities, including network protocol inspection, system call tracing, and real-time resource monitoring. It provides mechanisms for data enrichment to map kernel primitives to high-level identities like Kubernetes pods, alongside security features such as image signing and execution whitelisting. Users can execute these gadgets on local Linux hosts or deploy them across Kubernetes worker nodes using a daemonized operation model. ## Tags ### Operating Systems & Systems Programming - [eBPF Tooling](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/ebpf-tooling.md) — Provides a framework for executing eBPF-based inspection tools as container images across Linux hosts and Kubernetes clusters. ([source](https://www.inspektor-gadget.io/docs/latest/reference/)) - [eBPF Program Deployment](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/kernel-development/kernel-observability-programs/ebpf-program-deployment.md) — Manages the loading and execution of eBPF bytecode within the Linux kernel from a userspace application. ([source](https://www.inspektor-gadget.io/docs/latest/spec/operators)) - [CO-RE Portable eBPF Deployments](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/kernel-development/kernel-observability-programs/ebpf-program-deployment/co-re-portable-ebpf-deployments.md) — Ensures eBPF programs run across different kernel versions using Compile Once Run Everywhere (CO-RE) and BTF data. - [eBPF Program Bundling](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/kernel-development/kernel-observability-programs/ebpf-program-deployment/ebpf-program-bundling.md) — Bundles eBPF programs and metadata into OCI-compliant images for standardized distribution across environments. ([source](https://www.inspektor-gadget.io/docs/latest/)) - [Program Packaging Frameworks](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/kernel-development/kernel-observability-programs/ebpf-program-deployment/program-packaging-frameworks.md) — Provides a framework for building, packaging, and deploying eBPF programs as OCI-compliant container images. - [eBPF Program Development](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/kernel-development/kernel-observability-programs/ebpf-program-development.md) — Provides a framework for creating and packaging system inspection tools as eBPF programs. ([source](https://www.inspektor-gadget.io/docs/latest/gadget-devel/)) - [Kernel Telemetry Collection](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-telemetry-collection.md) — Gathers low-level kernel data and enriches it with Kubernetes-native identities like pod and container names. - [Portable Type Bindings](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-type-extractors/portable-type-bindings.md) — Generates type information using BTF to ensure eBPF programs remain portable across different kernel versions. ([source](https://www.inspektor-gadget.io/docs/latest/gadget-devel/)) - [BTF Data Loading](https://awesome-repositories.com/f/operating-systems-systems-programming/btf-data-loading.md) — Loads BPF Type Format files to enable the kernel to understand necessary data structures for eBPF programs. ([source](https://www.inspektor-gadget.io/docs/latest/spec/operators)) - [File Access Tracing](https://awesome-repositories.com/f/operating-systems-systems-programming/file-access-tracing.md) — Monitors and reports when processes open files to identify applications accessing sensitive system files. ([source](https://www.inspektor-gadget.io/docs/latest/gadgets/trace_open)) - [Linux System State Collection](https://awesome-repositories.com/f/operating-systems-systems-programming/linux-system-state-collection.md) — Executes data collection binaries directly on a Linux host to monitor system behavior. ([source](https://www.inspektor-gadget.io/docs/latest/quick-start)) - [Background Daemons](https://awesome-repositories.com/f/operating-systems-systems-programming/system-administration-maintenance/system-services/background-daemons.md) — Operates as a persistent background system process to allow for remote execution and management. ([source](https://www.inspektor-gadget.io/docs/latest/reference/ig)) ### System Administration & Monitoring - [Inspection Gadget Execution](https://awesome-repositories.com/f/system-administration-monitoring/inspection-gadget-execution.md) — Runs bundled eBPF inspection images on clusters or hosts to collect system data. ([source](https://www.inspektor-gadget.io/docs/latest/reference/run)) - [Linux Resource Monitors](https://awesome-repositories.com/f/system-administration-monitoring/linux-resource-monitors.md) — Provides a comprehensive suite of tools for monitoring system calls, network traffic, and resource usage on Linux hosts. - [eBPF-Based Collection](https://awesome-repositories.com/f/system-administration-monitoring/monitoring-and-observability/observability-platforms/telemetry-collection-aggregation/ebpf-based-collection.md) — Uses eBPF programs to collect high-performance system telemetry directly from the Linux kernel. - [System Call Tracing](https://awesome-repositories.com/f/system-administration-monitoring/diagnostic-tools/diagnostics/execution-tracers/kernel-tracing-frameworks/system-call-tracing.md) — Monitors kernel system calls in real time, including arguments and return values, for system tracing. - [Monitoring and Observability](https://awesome-repositories.com/f/system-administration-monitoring/monitoring-and-observability.md) — Implements a comprehensive framework for collecting kernel-level telemetry for system visibility. ([source](https://cdn.jsdelivr.net/gh/inspektor-gadget/inspektor-gadget@main/README.md)) - [Runtime Event Filters](https://awesome-repositories.com/f/system-administration-monitoring/audit-log-filters/log-event-filters/runtime-event-filters.md) — Filters live kernel event streams in real time to reduce noise before data is exported. ([source](https://www.inspektor-gadget.io/docs/latest/spec/operators)) - [Security Auditing](https://awesome-repositories.com/f/system-administration-monitoring/event-monitoring-systems/kernel-event-tracers/security-auditing.md) — Records system calls and monitors kernel security tracepoints to audit capability checks and system activity. ([source](https://www.inspektor-gadget.io/docs/latest/gadgets/)) - [Host Metadata Enrichments](https://awesome-repositories.com/f/system-administration-monitoring/host-metadata-enrichments.md) — Augments network addresses with pod and host identities to improve infrastructure visibility. ([source](https://www.inspektor-gadget.io/docs/latest/spec/operators)) - [System Metrics Collection](https://awesome-repositories.com/f/system-administration-monitoring/logging/system-metrics-collection.md) — Gathers native system-level performance metrics from the kernel for later analysis. ([source](https://www.inspektor-gadget.io/docs/latest/gadget-devel/)) - [System Usage Monitoring](https://awesome-repositories.com/f/system-administration-monitoring/monitoring-and-observability/observability-platforms/metric-performance-monitors/system-usage-monitoring.md) — Reports periodic statistics for CPU, memory, and disk I/O consumption. ([source](https://www.inspektor-gadget.io/docs/latest/gadgets/)) - [Container Network Connection Tracers](https://awesome-repositories.com/f/system-administration-monitoring/network-connectivity-monitoring/container-network-connection-tracers.md) — Traces live network connections, DNS queries, and TCP states within container contexts. ([source](https://www.inspektor-gadget.io/docs/latest/gadgets/)) - [Network Traffic Analysis](https://awesome-repositories.com/f/system-administration-monitoring/network-traffic-analysis.md) — Provides tools for isolating and filtering network data to identify high-bandwidth applications and hosts. ([source](https://www.inspektor-gadget.io/docs/latest/gadgets)) - [OpenTelemetry Exporters](https://awesome-repositories.com/f/system-administration-monitoring/opentelemetry-exporters.md) — Collects system metrics and profiles and exports them using the OpenTelemetry standard. - [Orchestration Resource Filters](https://awesome-repositories.com/f/system-administration-monitoring/organizational-unit-management/resource-filtering/orchestration-resource-filters.md) — Translates pod names into kernel resources to perform high-performance filtering directly in-kernel. ([source](https://cdn.jsdelivr.net/gh/inspektor-gadget/inspektor-gadget@main/README.md)) - [Performance Profiling Tools](https://awesome-repositories.com/f/system-administration-monitoring/performance-profiling-tools.md) — Samples stack traces and measures CPU and memory to identify performance bottlenecks. ([source](https://www.inspektor-gadget.io/docs/latest/gadgets/)) - [Process State Inspection](https://awesome-repositories.com/f/system-administration-monitoring/process-state-inspection.md) — Captures snapshots of running processes, open files, and active sockets for state analysis. ([source](https://www.inspektor-gadget.io/docs/latest/gadgets/)) - [System Resource Monitors](https://awesome-repositories.com/f/system-administration-monitoring/real-time-monitoring-systems/system-resource-monitors.md) — Reports real-time statistics for processes, files, and sockets to track system load. ([source](https://www.inspektor-gadget.io/docs/latest/gadgets)) - [Remote System Inspection](https://awesome-repositories.com/f/system-administration-monitoring/remote-system-inspection.md) — Enables the execution and management of inspection tools on remote Linux machines through a centralized controller. - [Telemetry Collection](https://awesome-repositories.com/f/system-administration-monitoring/telemetry-collection.md) — Captures performance data and exports it using standard telemetry protocols. ([source](https://www.inspektor-gadget.io/docs/latest/devel/)) - [Telemetry Exporters](https://awesome-repositories.com/f/system-administration-monitoring/telemetry-exporters.md) — Forwards system metrics and performance data to external storage or analysis platforms. ([source](https://www.inspektor-gadget.io/docs/latest/reference/)) - [Kernel Stack Trace Capture](https://awesome-repositories.com/f/system-administration-monitoring/trace-sampling/stack-trace-aggregators/kernel-stack-trace-capture.md) — Analyzes kernel and user-space stack traces to diagnose performance bottlenecks and system latency. ([source](https://www.inspektor-gadget.io/docs/latest/reference/)) - [Trace Event Filters](https://awesome-repositories.com/f/system-administration-monitoring/tracing-configuration/event-category-filters/trace-event-filters.md) — Limits gathered execution events via kernel or user-space filters to minimize system overhead. ([source](https://www.inspektor-gadget.io/docs/latest/reference/run)) - [User-Space Function Tracing](https://awesome-repositories.com/f/system-administration-monitoring/user-space-function-tracing.md) — Instruments binary or library functions in user-space to detect memory issues or deadlocks. ([source](https://www.inspektor-gadget.io/docs/latest/gadgets)) ### Data & Databases - [Wasm Post-Processing](https://awesome-repositories.com/f/data-databases/collection-post-processing/wasm-post-processing.md) — Executes WebAssembly modules to transform or analyze telemetry data before it is exported. ([source](https://www.inspektor-gadget.io/docs/latest/)) - [Wasm-Based Telemetry Processing](https://awesome-repositories.com/f/data-databases/data-processing-pipelines/wasm-based-telemetry-processing.md) — Implements a modular data processing pipeline using WebAssembly modules to transform and filter kernel telemetry. ([source](https://cdn.jsdelivr.net/gh/inspektor-gadget/inspektor-gadget@main/README.md)) - [Per-Process Resource Metrics](https://awesome-repositories.com/f/data-databases/data-analysis-visualization/telemetry-usage-analytics/metrics-collection/per-process-resource-metrics.md) — Collects per-process CPU and memory usage metrics by reading kernel data structures. ([source](https://www.inspektor-gadget.io/docs/latest/spec/operators)) - [System State Snapshotting](https://awesome-repositories.com/f/data-databases/data-snapshotting/system-state-snapshotting.md) — Captures a point-in-time view of active processes, files, and sockets. ([source](https://www.inspektor-gadget.io/docs/latest/gadgets)) ### Development Tools & Productivity - [Kubernetes Node Debugging](https://awesome-repositories.com/f/development-tools-productivity/application-debugging/remote-debugging/kubernetes-node-debugging.md) — Investigates specific Kubernetes cluster nodes using transient debug environments to troubleshoot workloads. ([source](https://inspektor-gadget.io/blog/2024/08/empowering-observability_the_advent_of_image_based_gadgets)) - [Hybrid Host-Container Execution](https://awesome-repositories.com/f/development-tools-productivity/command-execution/hybrid-host-container-execution.md) — Enables executing inspection programs either directly on a Linux host or within a container environment. ([source](https://inspektor-gadget.io/blog/2024/08/empowering-observability_the_advent_of_image_based_gadgets)) - [Runtime Debugging](https://awesome-repositories.com/f/development-tools-productivity/debugging-profiling-testing/debugging-diagnostics/debugging-inspection-tools/debugging-and-inspection-tools/runtime-debugging.md) — Detects mutex deadlocks and monitors memory allocations to troubleshoot active application behavior. ([source](https://www.inspektor-gadget.io/docs/latest/gadgets/)) ### DevOps & Infrastructure - [OCI-Compliant Packaging](https://awesome-repositories.com/f/devops-infrastructure/artifact-packaging-tools/oci-compliant-packaging.md) — Packages inspection tools as OCI-compliant artifacts for deployment across clusters and hosts. ([source](https://www.inspektor-gadget.io/docs/latest/specs/)) - [Container Image Packaging](https://awesome-repositories.com/f/devops-infrastructure/container-image-packaging.md) — Bundles eBPF programs, metadata, and modules into standard OCI container images. ([source](https://inspektor-gadget.io/blog/2024/08/empowering-observability_the_advent_of_image_based_gadgets)) - [Container Image Distribution](https://awesome-repositories.com/f/devops-infrastructure/container-orchestration/image-management-tools/container-image-distribution.md) — Bundles inspection tools and metadata into OCI-compliant container images for portable deployment across hosts. - [Telemetry Analysis Modules](https://awesome-repositories.com/f/devops-infrastructure/container-runtimes/wasm-execution-engines/telemetry-analysis-modules.md) — Executes WebAssembly code to process and analyze collected system data for observability. ([source](https://www.inspektor-gadget.io/docs/latest/spec/operators)) - [Kubernetes Node Debuggers](https://awesome-repositories.com/f/devops-infrastructure/kubernetes-node-debuggers.md) — Investigates specific Kubernetes cluster nodes using transient debug environments and containerized inspection images. - [Image Integrity Verification](https://awesome-repositories.com/f/devops-infrastructure/container-images/image-integrity-verification.md) — Validates container image signatures via a policy controller to block unsigned or unauthorized code from running. ([source](https://www.inspektor-gadget.io/docs/latest/reference/install-kubernetes)) - [Lifecycle Event Detection](https://awesome-repositories.com/f/devops-infrastructure/container-orchestration/container-runtimes/runtime-configuration-interfaces/docker-socket-orchestrators/docker-target-configurators/docker-container-deployments/container-lifecycle-management/lifecycle-event-detection.md) — Tracks when containers start and stop to trigger specific inspection programs. ([source](https://www.inspektor-gadget.io/docs/latest/reference/install-kubernetes)) - [Runtime API Tracing](https://awesome-repositories.com/f/devops-infrastructure/container-runtime-interfaces/runtime-api-tracing.md) — Inspects containers by communicating with runtime APIs and sockets across various container platforms. ([source](https://www.inspektor-gadget.io/docs/latest/reference/ig)) - [Inspection Daemon Deployment](https://awesome-repositories.com/f/devops-infrastructure/deployment-management/deployment-strategies/automated-deployments/inspection-daemon-deployment.md) — Installs background services on nodes to execute inspection images with specific security profiles. ([source](https://www.inspektor-gadget.io/docs/latest/reference/install-kubernetes)) - [Kubernetes Deployments](https://awesome-repositories.com/f/devops-infrastructure/kubernetes-deployments.md) — Deploys inspection programs across Kubernetes worker nodes to collect telemetry from workloads. ([source](https://www.inspektor-gadget.io/docs/latest/quick-start)) - [Remote Execution Interfaces](https://awesome-repositories.com/f/devops-infrastructure/remote-execution-interfaces.md) — Implements a gRPC-based remote execution interface to manage daemons and trigger gadgets on remote machines. ### Web Development - [Kernel Metadata Enrichment](https://awesome-repositories.com/f/web-development/user-metadata-management/event-metadata/cloud-metadata-enrichment/container-label-enrichment/kernel-metadata-enrichment.md) — Maps raw kernel primitives to high-level identities, such as Kubernetes pod names, using a processing pipeline. ### Networking & Communication - [gRPC Administrative Interfaces](https://awesome-repositories.com/f/networking-communication/grpc-administrative-interfaces.md) — Exposes system inspection capabilities via gRPC administrative interfaces for remote triggering from external applications. ([source](https://inspektor-gadget.io/blog/2024/08/empowering-observability_the_advent_of_image_based_gadgets)) - [gRPC Interfaces](https://awesome-repositories.com/f/networking-communication/grpc-interfaces.md) — Implements a gRPC interface to remotely manage inspection tools and retrieve system telemetry. ([source](https://www.inspektor-gadget.io/docs/latest/apis/)) - [Application-Layer Protocol Inspections](https://awesome-repositories.com/f/networking-communication/traffic-protocol-inspection/application-layer-protocol-inspections.md) — Parses and analyzes application-layer protocols such as DNS, TLS, and TCP to inspect network traffic. ([source](https://www.inspektor-gadget.io/docs/latest/gadgets)) ### Programming Languages & Runtimes - [Gadget Packaging Pipelines](https://awesome-repositories.com/f/programming-languages-runtimes/rust-based-compilers/ebpf-bytecode-compilers/gadget-packaging-pipelines.md) — Provides toolchains to compile eBPF source code and package it into distributable container images. ([source](https://www.inspektor-gadget.io/docs/latest/gadget-devel/building)) ### Repository Format - [Daemon Client Connections](https://awesome-repositories.com/f/repository-format/remote-connection-management/daemon-client-connections.md) — Allows connecting to a remote daemon on Linux hosts to execute and manage inspection programs from any OS. ([source](https://inspektor-gadget.io/blog/2024/08/empowering-observability_the_advent_of_image_based_gadgets)) ### Security & Cryptography - [Image Digest Whitelists](https://awesome-repositories.com/f/security-cryptography/access-restrictions/identity-whitelists/image-digest-whitelists.md) — Limits program execution to a predefined whitelist of authorized container image digests or tags. ([source](https://inspektor-gadget.io/docs/latest/reference/restricting-gadgets)) - [Application Execution Controls](https://awesome-repositories.com/f/security-cryptography/application-execution-controls.md) — Manages which specific inspection programs are permitted to run on the host to maintain system stability. ([source](https://www.inspektor-gadget.io/docs/latest/reference)) - [Binary Execution Restrictions](https://awesome-repositories.com/f/security-cryptography/binary-execution-restrictions.md) — Implements security controls to prevent the execution of unauthorized binaries or image assets on the host. ([source](https://cdn.jsdelivr.net/gh/inspektor-gadget/inspektor-gadget@main/README.md)) - [Container Image Signing](https://awesome-repositories.com/f/security-cryptography/code-signing/container-image-signing.md) — Provides digital signing for container image manifests to ensure the authenticity and integrity of inspection tools. ([source](https://www.inspektor-gadget.io/docs/latest/gadget-devel/)) - [Repository Trust Restrictions](https://awesome-repositories.com/f/security-cryptography/repository-trust-restrictions.md) — Restricts the retrieval of inspection tools to a set of defined trusted remote repositories. ([source](https://inspektor-gadget.io/blog/2024/08/empowering-observability_the_advent_of_image_based_gadgets)) ### Software Engineering & Architecture - [Privileged Container Execution](https://awesome-repositories.com/f/software-engineering-architecture/execution-control/namespace-isolation/namespace-provisioners/container-isolation/privileged-container-execution.md) — Operates within privileged containers to access host namespaces and load eBPF programs into the kernel. - [Modular Data Pipelines](https://awesome-repositories.com/f/software-engineering-architecture/modular-data-pipelines.md) — Implements modular data pipelines to modify how system telemetry is fetched, enriched, and filtered. ([source](https://inspektor-gadget.io/blog/2024/08/empowering-observability_the_advent_of_image_based_gadgets)) - [Wasm-Based Plugins](https://awesome-repositories.com/f/software-engineering-architecture/software-architecture/architectural-patterns/plugin-module-systems/modular-plugin-architectures/plugin-based-architectures/wasm-based-plugins.md) — Executes WebAssembly modules within the telemetry pipeline to transform and filter system data. ### Testing & Quality Assurance - [Remote Program Executions](https://awesome-repositories.com/f/testing-quality-assurance/general-testing-utilities/test-utilities-assertions/test-lifecycle-execution-control/test-execution-controls/remote-execution-controls/remote-computer-controllers/remote-program-executions.md) — Allows managing and executing inspection tools on remote Linux machines from a centralized controller. ([source](https://www.inspektor-gadget.io/docs/latest/quick-start))