Contact us
Pricing

Pricing

The open-source tools are free under AGPL-3.0. Tracepod Platform is in private beta — contact us for pricing.

Open Source

Free

AGPL-3.0. Self-hosted, in your own cluster.

  • eBPF sensor (DaemonSet) — profiles running containers via an openat() kprobe, no kernel module
  • harden CLI — builds minimized OCI images from a sensor profile, with recursive ELF dependency resolution
  • Confidence scoring — a 0–100 coverage signal for every build, with the full penalty breakdown
  • Removal manifest — the exact set of packages the hardening dropped, with file-level evidence
  • CycloneDX and SPDX SBOM generation (via syft), with optional cosign signing
  • Official Helm chart — DaemonSet, RBAC, values for kernel and runtime tuning
  • GitHub Action — build, smoke-test, and SBOM a hardened image in CI
  • Runtime presets for common language runtimes (e.g. Python)
See Open Source
Platform (Pro)

Contact us

Private beta. Deploys into your cluster via Helm. Data is sent outside the cluster only to endpoints you configure, such as webhooks, and to the vulnerability-database feed used for CVE scanning.

  • Web dashboard — fleet-wide CVE counts, size savings, and coverage for every workload
  • Sandbox validation — runs a hardened image in an ephemeral pod and checks it before it ships
  • Auto-fix loop — rebuilds and revalidates automatically when validation finds missing files
  • CVE delta reports — grype scan of source vs. hardened image, stored on the build record
  • Fleet policy & compliance — namespace-scoped policies with a pass/fail compliance report
  • Apply & drift detection — roll out the hardened image and get alerted when it drifts
  • Webhooks + source-image watching — build/validation/autofix events, and auto-rebuild on upstream digest changes
  • RBAC via Kubernetes TokenReview — no new identity system; roles set in a ConfigMap
  • Append-only audit log — every action recorded, exportable as CSV or JSON
  • OpenVEX export with reachability — based on whether a vulnerable component is present in the minimized image
  • Registry management — store and test target registry configs, anonymous or authenticated
Request access

Platform includes everything in Open Source, plus the features listed above. Both run inside your own cluster. Seehow Tracepod compares to other tools, or read thedocs before you decide what you need.

Not sure which you need?

Start with the open-source tools on one workload, and contact us when you want to roll it out across a fleet.

Contact us