Installation

Tracepod ships three binaries. Install only what you need:

Binary	Platform	You need it when
sensor	Linux (amd64/arm64)	Profiling containers — deployed as a DaemonSet via Helm, or run directly on a Linux host
harden	Linux + macOS (amd64/arm64)	Building minimized images from a profile — runs anywhere, no kernel dependency
tracepod	Linux + macOS (amd64/arm64)	Talking to the Tracepod controller (optional component, not in the OSS repo)

Prerequisites

For profiling (the sensor):

• Kubernetes cluster with containerd 1.7+ as the runtime (for the Kubernetes path)
• NRI enabled in containerd — see below
• cgroupv2 on nodes (default on Ubuntu 22.04+ and most modern distributions)
• The cluster must allow privileged: true DaemonSet pods
• Helm 3 (for the Kubernetes deployment path)

For hardening (the CLI): no special prerequisites. skopeo or crane is useful for importing the hardened image into a Docker daemon, and syft is required if you pass --sbom.

Enable NRI in containerd

The sensor integrates with containerd through NRI (Node Resource Interface). NRI must be enabled before installing the sensor — without it the sensor exits non-zero and refuses to run (the pod goes CrashLoopBackOff instead of tracing silently; see Requirements):

# /etc/containerd/config.toml on each node
[plugins."io.containerd.nri.v1.nri"]
  disable = false

Then restart containerd:

sudo systemctl restart containerd

Verify by running hack/discovery-probe.sh on the node — it checks the NRI socket directly rather than text-matching the config file.

Caution

Only containers managed by Kubernetes (kubelet → containerd) or started via crictl are profiled. Containers started with docker run, nerdctl run, or docker-compose are silently ignored, because they do not go through the containerd NRI interface. See Known limitations.

Install from GitHub releases

Pre-built binaries are published on the Releases page. Each binary ships in its own archive, named tracepod_<binary>_<version>_<os>_<arch>.tar.gz:

# Example: install harden v0.2.8 on Linux amd64
curl -fsSL \
  https://github.com/tracepod/tracepod/releases/download/v0.2.8/tracepod_harden_0.2.8_linux_amd64.tar.gz \
  | tar -xz harden
sudo install harden /usr/local/bin/harden

harden version

Substitute harden with sensor or tracepod, and adjust <os> (linux, darwin) and <arch> (amd64, arm64) as needed. A checksums.txt is published with every release.

Install the sensor via Helm (Kubernetes)

The sensor DaemonSet is deployed with the Helm chart from the repository checkout:

git clone https://github.com/tracepod/tracepod.git
cd tracepod

helm install tracepod ./helm/tracepod \
  --namespace tracepod \
  --create-namespace

The chart uses the sensor container image from GHCR (ghcr.io/tracepod/tracepod-sensor). See the Kubernetes deployment guide for chart values, verification steps, and troubleshooting. Running on Amazon EKS? See the EKS guide.

Build from source

The hardener and CLI build on macOS or Linux with Go 1.26+ and no cgo:

git clone https://github.com/tracepod/tracepod.git
cd tracepod
CGO_ENABLED=0 go build ./cmd/harden/
CGO_ENABLED=0 go build ./cmd/tracepod/

Building the sensor requires a Linux host with eBPF support, clang-18, and bpftool; see Requirements for which kernels that covers. macOS contributors can use the Lima VM configuration shipped in the repo — see CONTRIBUTING.md.

Next steps

• Quickstart — profile and harden your first container
• Kubernetes deployment — full Helm chart reference