On the recordRead 8 Oct 202618 facts
Kerno
On the record
- Deployment
- Kerno can run as a Kubernetes DaemonSet or as a binary on bare metal, VMs, EC2, and GCE; Docker images are published for Linux amd64 and arm64.github.com · read 8 Oct 2026
- Diagnosis rules
- The engine evaluates 11 deterministic rules covering issues such as disk I/O bottlenecks, OOM events, TCP retransmits, scheduler contention, and file descriptor leaks.github.com · read 8 Oct 2026
- Incident reports
- The `kerno doctor` command collects 30 seconds of kernel data and returns ranked findings with causes, evidence, ETAs, and suggested fixes.github.com · read 8 Oct 2026
- Integrations
- The project lists Prometheus metrics and ServiceMonitor support, Kubernetes pod enrichment, optional Anthropic, OpenAI, and Ollama providers, and systemd enrichment.github.com · read 8 Oct 2026
- Kernel requirement
- The quick start requires Linux kernel 5.8 or later with BTF; Helm or raw manifest deployment requires cluster-admin.github.com · read 8 Oct 2026
- License
- The repository identifies Kerno as licensed under Apache License 2.0.github.com · read 8 Oct 2026
- Monitoring
- Its watch commands cover TCP connections and retransmits, OOM kills, and file descriptor leak detection.github.com · read 8 Oct 2026
- Network policy limitation
- The README cautions that standard Kubernetes NetworkPolicy resources generally do not restrict Kerno because it uses host networking, unless host-firewall configuration is used.github.com · read 8 Oct 2026
- Permissions
- The documented Kubernetes security posture lists CAP_BPF, CAP_PERFMON, CAP_SYS_PTRACE, CAP_NET_ADMIN, and CAP_DAC_READ_SEARCH, and says the hot path does not require CAP_SYS_ADMIN.github.com · read 8 Oct 2026
- Privilege requirement
- Kerno needs elevated privileges or documented Linux capabilities to load eBPF programs into the kernel.github.com · read 8 Oct 2026
- Purpose
- Kerno is an eBPF-based incident diagnosis engine for production issues across Linux, Kubernetes, VMs, and bare metal.github.com · read 8 Oct 2026
- Requirements
- Kubernetes use requires Linux kernel 5.8 or later with BTF, and raw manifests or Helm installation require cluster-admin access.github.com · read 8 Oct 2026
- Roadmap limits
- The roadmap lists OpenTelemetry export and Grafana dashboards for v0.2, Slack and PagerDuty integrations for v0.3, and a managed Optiqor Cloud offering for v1.0.github.com · read 8 Oct 2026
- Security
- The project says Kerno makes no outbound network calls by default and that AI integration is opt-in through the configured provider.github.com · read 8 Oct 2026
- Security details
- The security policy says Kerno's eBPF programs are read-only observers and that it does not log file contents, environment variables, authentication tokens, or network payloads.github.com · read 8 Oct 2026
- Security posture
- The README says Kerno makes no outbound network calls by default and that AI integration is opt-in through a configured provider.github.com · read 8 Oct 2026
- Support
- The security policy directs general questions to GitHub Discussions and vulnerability reports to [email protected], with acknowledgment targeted within 48 hours.github.com · read 8 Oct 2026
- Tracing
- Kerno supports syscall latency, disk I/O latency, and CPU scheduler delay tracing.github.com · read 8 Oct 2026
