Contact us
Open-core · AGPL-3.0 · Kubernetes-native

Harden containers based on what they do at runtime.

Tracepod watches your workloads through an eBPF sensor and records every file they touch. From that record it builds a minimised OCI image, SBOMs you can sign with cosign, and a manifest of everything it removed. Nothing goes into the image that your workload didn’t use.

Read the quickstartSee the platform
bash

# Check the node can run the sensor before you install

$ curl -fsSLO \

    https://raw.githubusercontent.com/tracepod/tracepod/v0.2.8/hack/discovery-probe.sh

$ sudo bash discovery-probe.sh # run on a node; exit 0 = OK to install

 

# Install the eBPF sensor

$ git clone --branch v0.2.8 https://github.com/tracepod/tracepod

$ helm install tracepod ./tracepod/helm/tracepod \

    -n tracepod --create-namespace

 

# Grab the profile from the sensor on the node your workload ran on

$ NODE=$(kubectl get pod $POD -o jsonpath='{.spec.nodeName}')

$ SENSOR=$(kubectl -n tracepod get pod \

    -l app.kubernetes.io/name=tracepod-sensor --field-selector spec.nodeName=$NODE \

    -o jsonpath='{.items[0].metadata.name}')

$ kubectl -n tracepod exec $SENSOR -- \

    cat /profiles/$CONTAINER_ID/files.json > manifest.json

 

# Build and push the hardened image

$ harden build --manifest manifest.json \

    --source acme/web:1.4.2 \

    --output /tmp/hardened-web \

    --push registry.local/web:hardened

Files:       730 (680 direct, 42 inferred-elf, 8 manual/scratch-compat)

Confidence:  79/100 (Medium)

Layer:       17.2 MiB (down from 46.2 MiB)

Pushed:      registry.local/web:hardened

Example output.

Works
  • ✓
    Kubernetes nodes running containerd 2.x (NRI on by default), or containerd 1.7+ with NRI enabled
  • ✓
    Amazon Linux 2023, kernels 6.1, 6.12, and 6.18 (x86_64) — tested in CI on every pull request
  • ✓
    Containers started by kubelet (normal Pods) or crictl
  • ✓
    amd64 and arm64
Doesn’t work
  • ✗
    GKE Autopilot and AWS Fargate — no privileged DaemonSets
  • ✗
    Clusters that forbid privileged or hostPID pods
  • ✗
    Containers started with docker run, nerdctl run, or docker compose — not profiled
  • ✗
    cgroup v1 nodes

Not yet verified: Bottlerocket.Full requirements →

How it works

From recording to registry

Profile a workload once. The same recording drives the minimised image, the confidence score, and the SBOMs.

01

Profile

The eBPF sensor attaches kprobes to running containers and records every openat() call, scoped to the container’s cgroup. No kernel module to install.

02

Minimise

The new image layer contains the recorded files, their ELF shared-library dependencies, and language-runtime companions. Every file is tagged with the reason it was included.

03

Score

A confidence score is computed from the observation-source breakdown and profiling coverage. If the recording has gaps, the score says so before you ship.

04

Sign & attest

syft generates CycloneDX and SPDX SBOMs for the minimised image, with optional cosign signing. A removal manifest records every package that was dropped.

The manifest records why each file is in the image.

Most container-slimming tools hand you a flat file list and a smaller number. Tracepod records the source for each path in the manifest: whether the sensor saw it opened, an ELF dependency pulled it in, a language-runtime rule added it, or a person put it there. The confidence score is computed from that record, and it drops when profiling coverage has gaps.

A minimised image that crashes in production is worse than not hardening at all. The score surfaces coverage gaps before you deploy.

Read the concept docs
manifest.json (excerpt)
{
  "files": {
    "/usr/local/bin/python3.12": {
        "source": "direct",
        "access_modes": ["r", "x"],
        "count": 312
    },
    "/lib/x86_64-linux-gnu/libc.so.6": {
        "source": "inferred-elf",
        "access_modes": ["r", "m"]
    },
    "/usr/local/lib/python3.12/encodings/": {
        "source": "directory-inclusion"
    }
  }
}
directobserved by eBPF
inferred-elfELF shared-lib dependency
inferred-runtimelanguage-runtime companion
manualuser-added override

Everything you need is free and open source.
Platform adds fleet-wide tooling on top.

Open Source
AGPL-3.0
  • ✓
    eBPF sensorCO-RE kprobe sensor, ring buffer consumer, cgroup filtering
  • ✓
    Image builder (hardener)Minimised OCI image, ELF resolver, directory-inclusion mode
  • ✓
    harden CLIBuilds and pushes the minimised image from a recorded profile. Standalone static binary; works with nothing but the sensor output.
  • ✓
    Helm chartSensor DaemonSet with RBAC and ServiceAccount, ready for any containerd cluster
  • ✓
    GitHub ActionHarden, smoke-test, and SBOM images in your release pipeline
  • ✓
    CycloneDX + SPDX SBOMs + removal manifestSBOMs generated by syft, with optional cosign signing, plus a manifest of every package the hardening removed
View open-source tools
Platform
Pro

Runs in your cluster alongside the sensor. Data is sent outside the cluster only to endpoints you configure, such as webhooks, and to the vulnerability-database feed used for CVE scanning. Includes thetracepod CLI and everything in open source, plus:

  • ✓
    Web dashboardFleet view of workloads, builds, validations, and compliance
  • ✓
    Sandbox validationRun the hardened container in an ephemeral sandbox; detect missing files before you ship
  • ✓
    Auto-fix loopFailed validations trigger a rebuild that includes the missing paths, then a re-run. Up to three rounds, unattended.
  • ✓
    Build-time CVE deltagrype scans the source and hardened images on every build and reports exactly which findings the hardening removed
  • ✓
    One-click apply + drift detectionPatch the live workload; dashboard alerts when it drifts from the hardened ref
  • ✓
    Fleet policy & complianceNamespace-scoped policies: min coverage, hardened required, validated required
  • ✓
    OpenVEX export with reachabilityMachine-readable VEX documents based on whether a vulnerable component is in the minimised image
  • ✓
    Webhooks + source-image watchingAuto-rebuild when the source image changes; push outcomes to any endpoint
  • ✓
    RBAC + audit logSign-in reuses your cluster’s existing identity; Viewer, Operator, and Admin roles; append-only audit trail
Contact us

AGPL-3.0 licensed

The core toolchain is fully open. Inspect the code, run it yourself, and contribute upstream.

CycloneDX + SPDX SBOMs

Both formats, signed with cosign, so the output fits whichever scanner your security team already runs.

CO-RE, no kernel module

Pure eBPF with Compile Once, Run Everywhere — no per-node rebuild. See Requirements for tested kernels.

Kubernetes-native

Deploys as a DaemonSet, authenticates with TokenReview, and reuses your existing registry secrets. Requires no sidecar injection or admission webhook.

Try it on one workload.

Install the open-source tools, profile one deployment, and compare the image sizes. Contact us to run it across a fleet.

Read the quickstartContact us