How Tracepod compares
Tracepod is often compared with image minimizers, hardened base images, and runtime security tools. This page explains how each one relates to it.
Tracepod's distinguishing choice is how it decides what belongs in the image: it observes the real workload running in your cluster via eBPF and builds the minimized image from what that workload opened, rather than from a static analysis of the source image or a hand-maintained base.
SlimToolkit
SlimToolkit (formerly DockerSlim) is the closest thing to a direct comparison: it also produces a minimized image from an existing one. The difference is in how each tool decides what to keep. SlimToolkit instruments a container run and captures that run's behavior using its own sensor technique; Tracepod uses an eBPF kprobe on openat() running as a Kubernetes DaemonSet, profiling the workload in your own cluster under real traffic for as long as you choose. It also carries an explicit per-file observation source (direct, inferred, manually added) through to a confidence score, so you can see exactly how complete a given profiling run was.
Distroless, Chainguard, Docker Hardened Images
These are base-image swaps: you change your FROM line to a smaller, more carefully maintained base and get a reduced surface and (depending on the project) a faster CVE-patch cadence for the packages that base ships. That's a different axis from what Tracepod does: Tracepod builds a minimized image from observed runtime behavior on top of whichever source image you give it, independent of which base image that is. The two approaches stack: start from a hardened base, then let Tracepod trim it further to exactly what your workload uses.
Falco, Tetragon
Falco and Tetragon are runtime detection tools: they watch for anomalous or policy-violating behavior while your workload is running in production, and alert or block on it. Tracepod also uses eBPF, but for a different purpose and at a different point in the lifecycle — it profiles a workload to learn what it needs, then builds a new, smaller imagefrom that observation. Tracepod doesn't do runtime policy enforcement, and Falco/Tetragon don't produce a minimized image. Many teams use detection tooling and image minimization together, at different stages of the pipeline.
Kubescape
Kubescape's relevance scoring uses runtime file-activity data to help you triage which CVEs in a scan result matter — it tells you which vulnerable packages were exercised at runtime, so you can prioritize those first. That's a triage layer on top of your existing image; it doesn't change what ships in the image itself. Tracepod Platform's reachability reporting answers a related question (was the vulnerable package loaded during profiling?), but Tracepod's primary output — in the open-source core — is the minimized image itself, built from that same runtime-observation data, not a reordered vulnerability list.
We've tried to describe each of these fairly, based on how their own documentation describes them. If something here is out of date or you think we've mischaracterized a tool, tell us and we'll fix it.
Try it on your own workload
Install the open-source sensor and run a build against one of your workloads.