Tracepod Documentation
Profile running containers via eBPF. Build minimized OCI images containing only what your workload actually uses — with SBOMs, confidence scoring, and CVE reachability.
What is Tracepod?
Section titled “What is Tracepod?”Tracepod is an eBPF-based container hardening tool for Kubernetes. It attaches kprobes to your running workloads, records every file they open, exec, and map at runtime, and uses that observation to produce:
- Minimized OCI images — a single deterministic layer with only the files actually observed at runtime, plus recursively resolved ELF dependencies. Fewer files, fewer packages, fewer CVEs.
- A confidence score — quantifying how representative your profiling window was, with an exact breakdown of every remaining gap.
- CycloneDX + SPDX SBOMs — generated from the hardened image, optionally signed with cosign, plus a removal manifest listing every package that no longer ships.
- CVE reachability reports — per CVE, whether the affected package was actually loaded during profiling.
Browse the docs
Section titled “Browse the docs”| Section | What’s inside |
|---|---|
| Getting started | What Tracepod is, installation, first hardened image |
| Concepts | The eBPF sensor, observation sources & confidence, outputs, known limitations |
| Guides | Kubernetes deployment, GitHub Action, CVE reporting |
| Reference | CLI flags, runtime presets |