Inspektor Gadget

No entries match these filters. Clear filters

1. v0.57.0 Oct 5, 2026 · issue 096

   Inspektor Gadget v0.57.0 adds rootless ig run, ig image prune, and --drop-cap-sys-admin for reduced-privilege Kubernetes deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.57.0 https://github.com/inspektor-gadget/inspektor-gadget.git
   # already have the repo? check out this version:
   $ git checkout v0.57.0

   └──▷ TRY IT
   Deploy the Inspektor Gadget DaemonSet to a cluster without granting CAP_SYS_ADMINCAP_SYS_ADMINA Linux capability that grants a process a broad set of privileged operations — mounting filesystems, managing namespaces, and more — without full root, letting cyber tools perform system-level tasks under tighter privilege boundaries., accepting the trade-off of podinformer/NRI-based container detection instead of fanotify.
   copy

   $ kubectl gadget deploy --drop-cap-sys-admin

   Reclaim local disk space accumulated by superseded gadget image blobs after repeated pulls or builds.
   copy

   $ ig image prune

   • Adds --drop-cap-sys-admin flag to kubectl-gadget deploy to drop CAP_SYS_ADMIN and rely on CAP_BPF and CAP_PERFMON instead, disabling fanotify-based container detection and switching to a non-fanotify hook mode (podinformer/nri/crio).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds ig image prune command to reclaim blob disk space from unreferenced manifests in the local OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. store.
   • Enables rootless ig run requiring only cap_bpf, cap_perfmon, and cap_sys_ptrace — without CAP_SYS_ADMIN; falls back to reporting events from already-running containers when fanotify-based enrichment is unavailable.
   • Prunes unreferenced manifests from the local store's index.json automatically after pulls, builds, and removals, preventing unbounded index growth.
   • Improves advise_networkpolicy to exclude peers that cannot be reliably mapped to a pod (e.g. host-network pods) from generated rules and annotates them instead of producing incorrect policies.
   • Adds --drop-cap-sys-admin flag to kubectl-gadget deploy to drop CAP_SYS_ADMIN and rely on CAP_BPF and CAP_PERFMON instead, disabling fanotify-based container detection and switching to a non-fanotify hook mode (podinformer/nri/crio).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds ig image prune command to reclaim blob disk space from unreferenced manifests in the local OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. store.
   • Enables rootless ig run requiring only cap_bpf, cap_perfmon, and cap_sys_ptrace — without CAP_SYS_ADMIN; falls back to reporting events from already-running containers when fanotify-based enrichment is unavailable.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !snapshot_socket now reports socket state as a human-readable string (e.g. ESTABLISHED, LISTEN) instead of a raw numeric enum — any downstream parsing of the numeric value will break.
   • !top_process renamed its CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and Memory fields to shorter names — pipelines or scripts referencing the old field names will break.
2. docs update Sep 15, 2026 · issue 075

   Inspektor Gadget adds --oci-store-user flag to ig run, letting non-root users run gadgets from their own OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. store.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Build a gadget as a non-root user and run it under sudo without polluting the root OCI store or your home directory with root-owned files.
   copy

   $ ig image build -t mygadget
   sudo ig run --oci-store-user mygadget

   • Adds --oci-store-user flag to ig run to load a gadget from the invoking user's OCI store (~/.ig/oci-store) when running under sudo, avoiding root-owned files in the home directory; --pull is forced to never and signature downloads are disabled, so the gadget must be pulled as the user first.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Documents that gadget images are stored per-user: root's store is at /var/lib/ig/oci-store and all other users' stores are at ~/.ig/oci-store, so a gadget built as a non-root user is not visible to sudo ig image list.
   • All ig image subcommands (build, list, etc.) can be run without root; only ig run requires root to load eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. programs.
   • Adds --oci-store-user flag to ig run to load a gadget from the invoking user's OCI store (~/.ig/oci-store) when running under sudo, avoiding root-owned files in the home directory; --pull is forced to never and signature downloads are disabled, so the gadget must be pulled as the user first.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Documents that gadget images are stored per-user: root's store is at /var/lib/ig/oci-store and all other users' stores are at ~/.ig/oci-store, so a gadget built as a non-root user is not visible to sudo ig image list.

   1 more in Everything

3. docs update Sep 15, 2026 · issue 075

   Inspektor Gadget auto-detects container runtime socket paths via kubelet /configz on Kubernetes v1.33+, with manual override via daemon config.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds automatic container runtime socket path detection by querying the kubelet /configz endpoint on each node, enabled by default on Kubernetes v1.33+ clusters where nodes/configz RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. permission is granted automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports explicit socket path override via a daemon configuration file (daemon-config.yaml) for clusters where auto-detection via /configz is unavailable or returns a 403.
   • Adds automatic container runtime socket path detection by querying the kubelet /configz endpoint on each node, enabled by default on Kubernetes v1.33+ clusters where nodes/configz RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. permission is granted automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

4. v0.56.0 Sep 7, 2026 · issue 068

   Inspektor Gadget v0.56.0 adds Kubernetes multi-tenancy (RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.-enforced), rootless ig image commands, and uprobe support for stripped Go binaries.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.56.0 https://github.com/inspektor-gadget/inspektor-gadget.git
   # already have the repo? check out this version:
   $ git checkout v0.56.0

   • Adds --oci-store-user flag to sudo ig run to read gadgets from the per-user OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. store at ~/.ig/oci-store (built rootlessly) without creating root-owned files in the user home directory.
   • Adds experimental Kubernetes multi-tenancy mode: authenticates every kubectl-gadget request via TokenReview and restricts gadgets to RBAC-authorized namespaces using SubjectAccessReview, enforced in the gadget service via KubeManager.
   • Enables ig image build, ig image list, ig image inspect, ig image push, and ig image pull to run as a normal (non-root) user against a per-user OCI store at ~/.ig/oci-store.
   • Extends uprobetracer to fall back to Go's .gopclntab section (including the Go 1.26+ .go.module format) when the ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. symbol table is absent, enabling uprobes on stripped Go binaries such as a production kubelet.
   • Switches container runtime socket auto-detection to use the kubelet's /configz endpoint over HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate., requiring only the nodes/configz RBAC permission instead of the broader nodes/proxy (Kubernetes v1.33+; earlier clusters fall back to the configured socket path).

   +1 more show less

   • Reports network namespace in the trace_mount gadget output.
   • Adds --oci-store-user flag to sudo ig run to read gadgets from the per-user OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. store at ~/.ig/oci-store (built rootlessly) without creating root-owned files in the user home directory.
   • Adds experimental Kubernetes multi-tenancy mode: authenticates every kubectl-gadget request via TokenReview and restricts gadgets to RBAC-authorized namespaces using SubjectAccessReview, enforced in the gadget service via KubeManager.

   4 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Kubernetes deployments on v1.33+ now require the nodes/configz RBAC permission instead of nodes/proxy; clusters that granted only nodes/proxy must update their RBAC rules.
   • !ig image build, list, inspect, push, and pull now use a per-user OCI store at ~/.ig/oci-store instead of a root-owned store; gadgets previously built into the root store will not be visible to rootless ig image commands.
5. docs update Aug 11, 2026 · issue 042

   Inspektor Gadget adds gpu-ebpf-bridge, a userspace daemon bridging NVML GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. telemetry into four bpffs-pinned BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. maps for eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. gadget consumption.

   └──▷ TRY IT
   Start the bridge in a mixed GPU/non-GPU DaemonSet so nodes without GPUsGPUsA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. block harmlessly instead of crashing the pod.
   copy

   $ gpu-ebpf-bridge --mode=auto --poll-interval=500ms --idle-if-no-gpu --log-level=info

   Inspect live GPU telemetry on a host without bpftool installed — safe to run alongside a running bridge daemon.
   copy

   $ sudo gpu-ebpf-bridge --dump

   Run the bridge inside a container, pointing it at the host NVIDIA driver bind-mounted at /host and symlinking GPU device nodes into the container.
   copy

   $ gpu-ebpf-bridge --host-path=/host --symlink-nvidia-devs --nvml-library-path=/host/usr/lib64/libnvidia-ml.so.1 --mode=real

   • New gpu-ebpf-bridge daemon pins four BPF maps (gpu_meta, gpu_device, gpu_per_pid, gpu_per_pid_per_device) under /sys/fs/bpf/ at startup, allowing consumer eBPF gadgets to join GPU telemetry by PID or device index via a single hash lookup with no IPCIPCInter-process communication, ways for separate programs to exchange data or signals. Examples include pipes, sockets and shared memory..
   • Adds --poll-interval duration flag to control time between NVML polls (default 100ms).
   • Adds --mode string flag for backend selection: auto (default), real, or mock; auto tries the real NVML backend and falls back to mock on failure.
   • Adds --pin-dir string flag to configure where the four BPF maps are pinned (default /sys/fs/bpf).
   • Adds --dump flag to open all four pinned maps read-only, pretty-print their contents, and exit — usable as a built-in alternative to bpftool on hosts where it is not installed, safe to run alongside a live bridge daemon.

   +10 more show less

   • Adds --host-path string flag so the bridge can locate the host's NVIDIA driver when running inside a container with the host filesystem bind-mounted at a subtree.
   • Adds --symlink-nvidia-devs flag to glob ${host-path}/dev/nvidia* on startup and create symlinks in the container's /dev; requires --host-path.
   • Adds --nvml-library-path string flag to specify an absolute path to libnvidia-ml.so.1 for dlopen, bypassing the dynamic linker; if empty and --host-path is set, the bridge searches standard library subdirs under --host-path.
   • Adds --idle-if-no-gpu flag so the bridge logs a warning and blocks until SIGTERM instead of exiting when NVML init returns ErrNotAvailable — designed for DaemonSet deployments on mixed GPU/non-GPU clusters.
   • Adds --keep-pins flag (default false) to leave BPF maps pinned after the process exits for debugging; by default maps are cleaned up on SIGINT/SIGTERM.
   • Adds --log-level string flag supporting debug, info, warn, error levels (default info).
   • Exposes last_update_boottime_ns and clock_offset_ns fields in the gpu_meta map so consumer gadgets can reject stale telemetry and convert NVML CLOCK_REALTIME wall-clock fields to CLOCK_BOOTTIME using boottime_ns = realtime_ns − clock_offset_ns.
   • GPU type schema defined at include/gadget/gpu_types.h and loaded into the kernel's BTFBTFBPF Type Format, a metadata format in the Linux kernel that embeds type and debug information directly into eBPF programs, letting cyber tools inspect kernel structures safely without kernel headers at runtime. as part of the bridge's BPF object, enabling consumer gadgets to BPF_CORE_READ fields by name.
   • Supports real backend (requires NVIDIA driver >= 545 / CUDACUDANVIDIA's platform and programming interface for running general computation on its GPUs. Nearly every AI training and inference stack is built on it first. 12.3, October 2023) and mock backend (always compiled in, fabricates sinusoidal telemetry for CI and development).
   • Provides make gpu-ebpf-bridge (host binary, requires CGO and libnvidia-ml headers) and make gpu-ebpf-bridge-container (container image) build targets.

   15 details in Everything

6. docs update Aug 11, 2026 · issue 042

   Inspektor Gadget adds gpu-ebpf-bridge daemon to enrich kernel eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. events with per-process and per-device NVIDIA GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. telemetry via NVML

   └──▷ USE IT
   Enable the bridge with hostpath mode for clusters where toolkit-env fails (e.g. AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. pools that deny NVIDIA_VISIBLE_DEVICES from non-GPU-requesting pods).
   yaml copy

   bridges:
     gpu:
       enabled: true
       accessMode: hostpath

   • Adds bridges.gpu.enabled: true and bridges.gpu.accessMode helm values to deploy the gpu-ebpf-bridge sidecar inside the existing IG DaemonSet; three access modes supported: toolkit-env (default), hostpath, and device-plugin.
   • Adds --idle-if-no-gpu flag to gpu-ebpf-bridge so the sidecar stays in Running state on non-GPU nodes instead of crashing, preserving fleet-wide observability on mixed clusters; the helm chart passes it unconditionally when bridges.gpu.enabled=true.
   • Adds --mode=real and --keep-pins=true flags to gpu-ebpf-bridge for standalone and kubectl debug node deployments; --keep-pins=true leaves the four bpffs-pinned BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. maps (gpu_device, gpu_per_pid, gpu_per_pid_per_device) visible after the bridge exits.
   • Adds --dump flag to gpu-ebpf-bridge to inspect the four BPF maps and verify per-GPU and per-PID entries are being populated.
   • New gpu-ebpf-bridge daemon polls NVIDIA GPU telemetry via NVML and publishes it through four bpffs-pinned BPF maps (BPF_MAP_TYPE_LRU_HASH), enabling consumer gadgets to enrich kprobe/uprobe/tracepoint events with GPU context in a single hash lookup at event emit time; requires NVIDIA driver >= 545 and kernel >= 5.8.

   +2 more show less

   • Supports kubectl debug node ad-hoc deployment of the bridge via ghcr.io/inspektor-gadget/gpu-ebpf-bridge:latest alongside ghcr.io/inspektor-gadget/ig:latest, sharing /sys/fs/bpf under --profile=sysadmin.
   • Supports Docker sibling-container deployment of gpu-ebpf-bridge and ig, sharing /sys/fs/bpf via a bind mount, with GPU access granted only to the bridge container via --gpus all.

   7 details in Everything

7. docs update Aug 11, 2026 · issue 042

   Inspektor Gadget adds three new GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. observability gadgets: per-device telemetry, per-process usage, and starvation detection.

   • New gpu_top gadget reports real-time per-device GPU telemetry.
   • New gpu_top_per_pid gadget reports per-process GPU usage.
   • New trace_gpu_starvation gadget detects GPU starvation — identifying processes being starved of GPU access.

   3 details in Everything

8. docs update Aug 11, 2026 · issue 042

   Inspektor Gadget adds gpu-ebpf-bridge daemon for per-device and per-process GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. telemetry via BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module.-pinned maps.

   └──▷ TRY IT
   Inspect the BPF-pinned GPU maps published by the daemon to verify telemetry is flowing before attaching a consumer gadget.
   copy

   $ gpu-ebpf-bridge --dump

   • New gpu-ebpf-bridge daemon exposes per-device and per-process GPU telemetry to consumer gadgets via four bpffs-pinned maps.
   • New gpu-ebpf-bridge CLI with configurable backends, flags, and a built-in --dump flag for live debugging of published BPF maps.

   2 details in Everything

9. v0.55.0 Aug 3, 2026 · issue 035

   Inspektor Gadget v0.55.0 adds a gpu-ebpf-bridge daemon for GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. telemetry, map pinning, non-destructive map iteration, and three new eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. program types.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.55.0 https://github.com/inspektor-gadget/inspektor-gadget.git
   # already have the repo? check out this version:
   $ git checkout v0.55.0

   • eBPF operator now supports map pinning via LIBBPF_PIN_BY_NAME in gadget maps and non-destructive map iteration via iter/bpf_map_elem with GADGET_ITER_TARGET_MAP.
   • Adds support for ebpf.SockOps, ebpf.SkSKB, and ebpf.SkMsg eBPF program types in the eBPF operator.
   • Enables OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor./Python stack symbolization for perf_event-based gadgets (e.g. profile_cpu), including aggregation of identical stacks.

   3 details in Everything

10. v0.54.0 Jul 6, 2026 · issue 014

    Inspektor Gadget v0.54.0 adds Cilium NetworkPolicyNetworkPolicyA Kubernetes API object that defines which pods may send or receive traffic, enforced by the cluster's CNI plugin to give cyber tools namespace-level network segmentation without host firewall rules. generation, Helm resource limits, and improved exec arg capture.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.54.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.54.0

    └──▷ TRY IT
    Generate a Cilium-native NetworkPolicy by observing live traffic, ready to apply directly to a Cilium-managed cluster.
    copy

    $ kubectl gadget run advise_networkpolicy:latest --policy-format cilium

    Constrain Inspektor Gadget DaemonSet resource usage at deploy time to satisfy admission policies or resource quotas.
    copy

    $ helm upgrade --install gadget gadget/gadget --set resources.requests.cpu=100m --set resources.requests.memory=128Mi --set resources.limits.cpu=500m --set resources.limits.memory=512Mi

    • Adds --policy-format cilium option to advise_networkpolicy, enabling generation of Cilium NetworkPolicy resources in addition to the existing Kubernetes NetworkPolicy output.
    • Enables CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and memory requests and limits for the Inspektor Gadget DaemonSet via the Helm chart resources field, so deployments fit within cluster resource quotas.
    • Improves trace_exec to read process arguments from the new process address space, capturing more accurate argv data for executed processes.
    • Adds support for profile names in OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. profiles (otel-profiles).
    • Introduces a user-provided BTFBTFBPF Type Format, a metadata format in the Linux kernel that embeds type and debug information directly into eBPF programs, letting cyber tools inspect kernel structures safely without kernel headers at runtime. cache in the eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. subsystem (ebpf v0.22.0 upgrade), reducing repeated BTF processing overhead at scale.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. are removed from the image index and signed separately, which may break workflows that retrieve SBOMs directly from the image index.
11. advisory CVE-2026-53941 Jun 16, 2026 · issue 128
    • CVE-2026-53941: Uprobe gadgets: unprivileged container's ld.so.cache causes high CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. utilization and container startup DoS (affects >= v0.27.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
12. advisory CVE-2026-44778 Jun 16, 2026 · issue 128
    • CVE-2026-44778: Unprivileged container can crash USDTUSDTUserspace Statically Defined Tracing probes, a mechanism originating in Solaris and adopted by Linux, that lets a program embed named hook points so debuggers and tracers can attach at runtime with near-zero overhead when idle. note parser via crafted ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. (no shipped gadget affected) (affects >= v0.28.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
13. v0.53.0 Jun 1, 2026 · release notes

    Inspektor Gadget v0.53.0 adds trace_link gadget, Python 3.13 TLS profiling support, and cleaner ustack symbol output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.53.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.53.0

    └──▷ TRY IT
    Trace BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. link creation/deletion events system-wide to audit eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. program attachment activity.
    copy

    $ ig run trace_link

    Start the ig daemon allowing insecure TLS connections, useful in lab environments without valid certificates.
    copy

    $ ig daemon --tls-insecure

    • Adds new trace_link gadget for tracing BPF link operations.
    • Supports Python 3.13 TLS in the eBPF-based continuous profiler via updated otel-ebpf-profiler.
    • Improves user-space stack (ustack) symbol display: removes [N] index prefix and shows binary path with offset instead.
    • Adds --tls-insecure flag to ig daemon for insecure TLS connections.

    4 details in Everything

14. v0.52.0 May 4, 2026 · release notes

    Inspektor Gadget v0.52.0 adds OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. Profiler symbolization for interpreted languages and Helm gadgetConfigMaps support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.52.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.52.0

    • Adds OTel eBPF Profiler symbolizer to ustack for resolving interpreted-language (e.g. Python, JVMJVMThe Java Virtual Machine, a runtime maintained by Oracle (and implemented by others) that executes Java bytecode on any OS, giving cyber tools a portable, garbage-collected environment with a large ecosystem of libraries.) stack frames in profiling output.
    • Adds gadgetConfigMaps support to the Helm charts, enabling configuration via Kubernetes ConfigMaps.
    • Extends trace_init_module gadget with finit_module syscall support for broader kernel module load tracing.
    • Adds CO-RE helpers for inode ctime and syscall access, expanding eBPF gadget authoring capabilities.
    • Adds service name metadata to OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. profiles output.

    5 details in Everything

15. v0.51.0 Apr 7, 2026 · release notes

    Inspektor Gadget v0.51.0 adds CUDACUDANVIDIA's platform and programming interface for running general computation on its GPUs. Nearly every AI training and inference stack is built on it first. profiling/memory gadgets, CFS throttle detection, and a new logs operator.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.51.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.51.0

    • New profile_cuda gadget for profiling CUDA GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. workloads with eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic..
    • New top_cpu_throttle gadget to detect and surface CFS bandwidth throttling per container/process.
    • New CUDA memory metrics gadget for tracking GPU memory usage.
    • Introduces a logs operator enabling log-stream integration within the gadget pipeline.
    • Helm chart now supports configuring hostPIDhostPIDA Kubernetes pod setting that lets containers in the pod share the host node's process ID namespace, giving them visibility into — and potential control over — all processes running on the node. and hostNetwork for the DaemonSet.

    +1 more show less

    • Network policy generator operator (op/generate_networkpolicy) now uses podSelector for Services, improving generated policy accuracy.

    6 details in Everything

16. advisory CVE-2026-31890 Mar 12, 2026 · issue 128
    • CVE-2026-31890: Tracing Denial of Service via Event Flooding (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects <v0.50.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
17. v0.50.0 Mar 2, 2026 · release notes

    Inspektor Gadget v0.50.0 adds a kernel module tracing gadget and container image digest filtering.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.50.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.50.0

    • New trace_init_module gadget to trace kernel module loading events.
    • Supports filtering container collection by image digests.

    2 details in Everything

18. advisory CVE-2026-25996 Feb 12, 2026 · issue 128
    ▶ ⤢
    • CVE-2026-25996: Unsanitized ANSI Escape Sequences In columns Output Mode (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects <=v0.49.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
19. v0.49.0 Feb 2, 2026 · release notes

    Inspektor Gadget v0.49.0 adds OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. profiles export and a new --gadgets-only flag for bpfstats.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.49.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.49.0

    └──▷ TRY IT
    Filter bpfstats output to only gadget-owned eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. programs, replicating the old default behavior after the breaking change.
    copy

    $ ig run bpfstats --gadgets-only

    • Adds OpenTelemetry profiles support to exporters, enabling profiling data to be shipped via the OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. pipeline.
    • New --gadgets-only flag for the bpfstats gadget filters output to show only Inspektor Gadget eBPF programs instead of all eBPF programs.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --all flag for the bpfstats gadget has been removed; showing all eBPF programs is now the default behavior. To restore the previous behavior of showing only gadget programs, pass --gadgets-only.
20. advisory CVE-2026-24905 Jan 29, 2026 · issue 128
    • CVE-2026-24905: Command Injection in Makefile.build (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects <v0.51.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
21. v0.48.0 Jan 5, 2026 · release notes

    Inspektor Gadget v0.48.0 adds a Snapshot File gadget, container selector exclusions, and a new from_rootfs field in trace_exec.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.48.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.48.0

    • New snapshot-file gadget captures a point-in-time view of open files across processes.
    • Supports exclusion filters and multiple values in container selectors, enabling finer-grained gadget targeting.
    • Adds from_rootfs field to trace_exec gadget to indicate whether an executed binary originates from the container root filesystem.
    • Enables clear-screen-before display mode for profile gadgets in the CLI, giving cleaner live output.
    • Helm charts now include Kubernetes recommended labels by default, improving resource discoverability and compatibility with standard tooling.

    5 details in Everything

22. v0.47.0 Dec 1, 2025 · release notes

    Inspektor Gadget v0.47.0 adds image verification, cosign bundle support, symlink-resolved file paths in trace_open, and stdin manifest apply.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.47.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.47.0

    └──▷ TRY IT
    Apply a gadget manifest piped from another command without writing it to disk first.
    copy

    $ cat my-gadget.yaml | ig run -f -

    • Adds ig image verify command to verify gadget image signatures from the CLI.
    • Supports cosign bundle format for gadget image signature verification.
    • Adds resolved file path (after symlink resolution) to trace_open events.
    • Allows -f - to apply a gadget manifest from stdin.
    • Adds metricname annotation support to the otel-metrics operator for custom metric naming.

    +1 more show less

    • Appends sort fields when the same datasource is specified multiple times in the sort operator.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The otel-metrics operator now defaults metricname to FullName instead of the previous default, which may change metric names in existing dashboards or alerting rules on upgrade.
23. v0.46.0 Nov 3, 2025 · release notes

    Inspektor Gadget v0.46.0 adds gadget instance status support and MicroK8s runc path detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.46.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.46.0

    • Adds instance status support to gadget-service, enabling visibility into the state of running gadget instances.
    • Adds runc path detection for MicroK8s environments, enabling Inspektor Gadget to work on MicroK8s clusters.
    • Adds gadget_socket_lookup_with_direction helper to the eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. include headers for gadget authors.
    • Supports OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. 1.1 method for retrieving cosign signatures alongside the legacy .sig tag approach.
    • Adds Puller and Exporter interfaces for both cosign legacy .sig tag and OCI 1.1 signature retrieval.

    +2 more show less

    • Enables notation signature verification using a local store.
    • Renames snapshotters to iters and makes them repeatable, enabling periodic re-execution of snapshot-style gadgets.

    7 details in Everything

24. v0.45.0 Oct 6, 2025 · release notes

    Inspektor Gadget v0.45.0 adds a new tcpdump gadget with generic packet filters, PIE symbolization, and Notation signature verification.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.45.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.45.0

    • Introduces generic packet filters and a new tcpdump gadget for packet-level capture and filtering via eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic..
    • Adds PIE (Position Independent Executable) support in the symbolizer, enabling accurate user-space stack symbolization for PIE binaries.
    • Adds Notation-based signature verification for gadget artifacts alongside the existing Cosign support.
    • Supports runtime/Kubernetes filtering in localmanager and kubemanager, enabling more granular gadget targeting.
    • Adds a buildid field to ustack output to support client-side symbolization workflows.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The undeploy command removes legacy logic for deleting old IG deployments — clusters with older Inspektor Gadget deployments may not be cleaned up correctly on upgrade.
    • !In the trace_exec gadget, arguments are now joined with a non-breaking space (nbsp) instead of a regular space, which may break parsers or scripts that split on whitespace.
25. v0.44.0 Sep 1, 2025 · release notes

    Inspektor Gadget v0.44.0 adds ttysnoop gadget, human-readable open-mode/flag formatters, and custom OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. gadget parameters.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.44.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.44.0

    • New ttysnoop gadget for snooping on TTY/terminal activity.
    • Adds built-in formatters for mode and flags fields in trace_open, surfacing human-readable permission and flag strings instead of raw integers.
    • Enables gadget authors to define custom parameters directly in gadget.yaml for OCI-packaged gadgets.
    • Adds count annotation/parameter to top_process gadget for controlling the number of displayed processes.

    4 details in Everything

26. v0.43.0 Aug 4, 2025 · release notes

    Inspektor Gadget v0.43.0 adds Helm imagePullSecrets support, Expr-based filter expressions, and traceloop socket parsing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.43.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.43.0

    └──▷ TRY IT
    Uninstall Inspektor Gadget without deleting the namespace, safe for shared namespace environments.
    copy

    $ kubectl gadget undeploy

    • Adds Helm imagePullSecrets support for the DaemonSet image, enabling deployments from private registries.
    • Introduces filter expressions based on the Expr language in the filter operator, enabling richer, programmable event filtering.
    • Traceloop displays wider parameters column, improving readability of syscall arguments.
    • kubectl-gadget undeploy no longer removes the namespace, preventing accidental deletion of shared namespaces on uninstall.
    • Makes the default OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registry URL for image-based gadgets configurable at build time.

    +1 more show less

    • Updates vmlinux.h to Linux 6.15.5, extending eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. CO-RE support for the latest kernel.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !kubectl-gadget undeploy removes known resources from versions prior to v0.43.0, which may alter cleanup behavior when upgrading from older deployments.
27. v0.42.0 Jul 7, 2025 · release notes

    Inspektor Gadget v0.42.0 adds Rust WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. bindings, removes built-in gadgets, and expands trace_tcp, image, and deploy capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.42.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.42.0

    └──▷ TRY IT
    Import a gadget image and get machine-parseable JSON output for scripting or CI pipelines.
    copy

    $ ig image import <path> --output json

    • Adds Rust WASM bindings, enabling gadget authors to write gadgets in Rust targeting the WASM API.
    • Adds accept-only parameter to trace_tcp to filter captured events to accepted connections only.
    • Adds tty field to process/exec event data.
    • Allows gadgets to specify default values for parameters in their metadata.
    • Adds support for a config file in the deploy command.

    +9 more show less

    • Supports extra environment variables for the DaemonSet via Helm charts.
    • Handles gadget signatures during image export and image import operations.
    • Adds JSON output mode to the image import command.
    • Adds a default gadget namespace to Helm charts.
    • Introduces PreCreateContainer events in the container hook lifecycle.
    • Sets visibility controls on formatted/derived columns.
    • Provides human-readable format for bytes and duration fields in bpfstats and top_process.
    • Uses CO-RE in socketenricher, making it resilient to kernel struct layout changes.
    • Caches gadget OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. signatures via ORASORASA CNCF project implementing the OCI Registry as Storage specification, letting tools push and pull arbitrary artifacts—not just container images—to and from any OCI-compliant registry. to speed up repeated pulls.

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !All built-in gadgets have been removed treewide; gadgets must now be referenced as OCI images.
    • !Deprecated environment variables in gadgettracermanager have been removed; configs must be migrated to the supported config file.
    • !Support for torcx has been removed; environments relying on torcx for container runtime integration will no longer work.
28. v0.41.0 Jun 2, 2025 · release notes

    Inspektor Gadget v0.41.0 adds top_process gadget, advise_networkpolicy image gadget, DNS nameserver field, and more.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.41.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.41.0

    └──▷ TRY IT
    Enrich ig events with Kubernetes API server metadata using a specific kubeconfig.
    copy

    $ ig run trace_exec --enrich-with-k8s-apiserver --kubeconfig ~/.kube/config

    • New top_process gadget via the process operator for real-time per-process resource monitoring.
    • Ports advise_networkpolicy to image-based gadget, enabling OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant.-distributed network policy recommendations.
    • Ports profile_cpu to image-based gadget for OCI-distributable CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. profiling.
    • Adds nameserver field to trace_dns output for tracking which DNS server handled each query.
    • Adds parent_exepath field to built-in trace_exec gadget for tracing the full path of parent processes.

    +12 more show less

    • Adds comm, pid, and progtype fields to bpfstats gadget output for richer BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. program visibility.
    • Removes the --enable-bpfstats requirement from the bpfstats gadget — now always available.
    • Adds --kubeconfig option to ig for use with --enrich-with-k8s-apiserver.
    • Adds syscall filtering support (ported to image-based gadget framework).
    • Adds runtimeClassName support to the Helm chart DaemonSet for node-level runtime targeting.
    • Adds runc path support for k0s and Bottlerocket OS, expanding container runtime discovery.
    • Improves inspect command UX with datasources, fields listing, and consistent sorting.
    • Introduces internal metrics infrastructure for observability of Inspektor Gadget itself.
    • Adds a startup probe to the DaemonSet for more reliable Kubernetes deployment health signaling.
    • Allows escaping comma characters in string slice parameters for more expressive gadget configuration.
    • Publishes OCI container config as a string in container-collection events.
    • Adds Go WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. API constants for the containers datasource.

    17 details in Everything

29. v0.40.0 May 5, 2025 · release notes

    Inspektor Gadget v0.40.0 adds a bpfstats gadget, image-based advise_seccomp, inspect command for kubectl-gadget, and WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. caching.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.40.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.40.0

    └──▷ TRY IT
    Build a custom gadget image and control how the builder image is pulled (e.g., always pull the latest builder in CI).
    copy

    $ ig image build --builder-image-pull always -t myregistry/mygadget:latest .

    • New bpfstats gadget for inspecting eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. program statistics.
    • Implements advise_seccomp as an image-based gadget.
    • Adds inspect command to kubectl-gadget with OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. metadata, mermaid graphs, and eBPF relocation details.
    • WASM operator now uses a cache to significantly speed up gadget execution.
    • Adds ls and rm aliases for ig image list and ig image remove.

    +5 more show less

    • Adds --builder-image-pull flag to ig image build to control builder image pull behavior.
    • Introduces value.one-of annotation for gadget parameter validation.
    • Adds generic collect-ustack parameter and templates for user-space stack collection.
    • KubeNameResolver now supports image-based gadgets.
    • Adds Kubernetes recommended labels to Helm chart resources.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The ebpf-builder image is renamed to gadget-builder; any references to ebpf-builder in build scripts or configs must be updated.
30. v0.39.0 Apr 7, 2025 · release notes

    Inspektor Gadget v0.39.0 adds user stacks to audit_seccomp and trace_open, converts traceloop to image-based gadget, and expands inspect capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.39.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.39.0

    └──▷ TRY IT
    Capture user-space call stacks alongside seccomp audit events to identify which code paths trigger policy violations.
    copy

    $ ig run audit_seccomp --collect-ustack=true

    • Converts traceloop to an image-based gadget, aligning it with the modern gadget distribution model.
    • Adds user-space stack capture to gadget audit_seccomp via the collect-ustack parameter.
    • Adds user-space stack capture to gadget trace_open via the collect-ustack parameter.
    • Adds --symbolizers parameter to user-stack (ustack) resolution for controlling symbol resolution backends.
    • Extends inspect command with eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. and WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. extra info display.

    +6 more show less

    • Makes inspect pull policy and image verification configurable via new flags.
    • Adds uniform filtering support for networking gadgets.
    • Adds support for Linux 5.4 in the fsnotify gadget.
    • Updates syscall table to Linux v6.13.0.
    • Renames stack-collection gadget params from print-*stack to collect-*stack.
    • WASM gadget layer switches from TinyGo to Go 1.24, enabling full Go standard library support in WASM gadgets.

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Gadget stack parameters are renamed from print-*stack to collect-*stack; existing scripts or workflows using the old parameter names will break.
    • !WASM module name changed from env to ig; WASM gadgets referencing the env module name must be updated.
31. v0.38.0 Mar 3, 2025 · release notes

    Inspektor Gadget v0.38.0 adds user stack traces, a qdisc latency profiler, DNS-over-TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. tracing, and a new env-var field operator.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.38.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.38.0

    └──▷ TRY IT
    Profile queueing discipline latency on a node to diagnose network throughput bottlenecks in containerised workloads.
    copy

    $ ig run ghcr.io/inspektor-gadget/gadget/profile_qdisc_latency:latest

    • Adds initial support for user-space stack traces in eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. gadgets.
    • New qdisc_latency tracer gadget profiles network queuing discipline latency.
    • Supports DNS tracing over TCP (without packet reassembly) in trace_dns.
    • New env operator enables creating new data fields from environment variables in gadget pipelines.
    • Adds getSyscallID() WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. host function to look up a syscall ID by name from guest gadgets.

    +4 more show less

    • Expands trace_capabilities gadget support to Linux kernels older than 6.1.
    • Allows overriding OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. export key/name via the otel operator.
    • Warns the user when a gadget is run against a mismatched Inspektor Gadget version.
    • Displays fsnotify external API masks as human-readable strings instead of raw integers.

    9 details in Everything

32. v0.37.0 Feb 3, 2025 · release notes

    Inspektor Gadget v0.37.0 adds execveat tracing, failed-connection filtering, richer exec fields, and expanded WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. APIs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.37.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.37.0

    └──▷ TRY IT
    Filter trace_exec output on a value containing a comma by escaping it, so the filter parser treats it as a single value.
    copy

    $ ig trace_exec --filter 'comm=foo\,bar'

    • Adds execveat syscall support to trace_exec gadgets, covering exec-via-file-descriptor paths missed by execve alone.
    • Merges trace_tcpconnect into trace_tcp, unifying TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connection tracing under a single gadget.
    • Adds --failed-only option to trace_tcp to surface only failed TCP connections.
    • Adds dev, inode, and fupper_layer fields to trace_exec for identifying executed file identity and overlay-filesystem layer.
    • Adds ptid (parent thread ID) field to trace_exec events.

    +11 more show less

    • Adds exepath to trace_exec output even when execution fails.
    • Adds additional DNS metadata fields to DNS trace output.
    • Provides human-readable representations of bytes and time durations in gadget output.
    • Adds fd field to trace_tcp events.
    • Adds WASM API functions to get syscall names and declarations from gadgets.
    • Adds WASM API support for array and hash map types.
    • Adds WASM API functions to interact with perf buffers.
    • Adds kallsymsSymbolExists WASM helper for runtime kernel symbol checks.
    • Allows escaping commas in filter expressions, enabling filtering on values that contain commas.
    • Adds support for non-unix://-prefixed socket paths in container runtime configuration.
    • Returns client version from kubectl-gadget even when the server is unreachable.

    16 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !trace_tcpconnect is merged into trace_tcp; any scripts or workflows invoking trace_tcpconnect as a standalone gadget will need to switch to trace_tcp.
    • !Built-in gadgets are deprecated tree-wide; existing setups relying on built-in gadgets should migrate to image-based gadgets.
33. v0.36.0 Jan 6, 2025 · release notes

    Inspektor Gadget v0.36.0 adds OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. logs export, richer DNS/exec tracing fields, and uniform gadget filtering.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.36.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.36.0

    └──▷ TRY IT
    Capture DNS queries with working directory and executable path to attribute queries to specific scripts or binaries.
    copy

    $ ig trace dns --paths

    • Adds OpenTelemetry logs (otel-logs) support for exporting gadget output to OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor.-compatible backends.
    • Adds cwd and exepath fields to trace_dns via the --paths flag for richer process context on DNS events.
    • Adds file field to trace exec to capture the interpreter path for script executions.
    • Introduces uniform filtering across gadgets for consistent field-based event filtering.
    • Allows configuring otel-metrics via Helm charts for Kubernetes deployments.

    +1 more show less

    • Enforces unique instance names in kubectl-gadget, preventing duplicate named gadget instances.

    6 details in Everything

34. v0.35.0 Dec 2, 2024 · release notes

    Inspektor Gadget v0.35.0 adds deadlock detection, a new fdpass gadget, WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. map APIs, and TID/exepath fields.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.35.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.35.0

    └──▷ TRY IT
    Trace file-descriptor passing between processes (e.g. to audit privilege hand-off via SCM_RIGHTS).
    copy

    $ ig run gadgets/fdpass

    • New fdpass gadget traces file-descriptor passing between processes.
    • New deadlock gadget detects deadlocks by finding cycles in mutex wait directed graphs, with PID-based filtering and dead-process handling.
    • Adds WASM API functions to create, close, and manipulate eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. maps from WASM gadgets.
    • Adds Unreference (formerly SetRequested) and AddTags methods to the WASM API for datasource and field accessor control.
    • Enhances version command output with JSON format support.

    +4 more show less

    • Adds Thread ID (TID) field to execsnoop and open gadgets.
    • Adds exepath field to the trace_exec image-based gadget.
    • Expands exec argument capture to support up to 256 bytes per argument.
    • Monitoring tooling now uses an OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. metrics exporter.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !JSON output for image-based gadgets now nests process-related fields (comm, pid, tid, uid, gid, pcomm, mntns_id) under a proc leaf node; consumers must update their unmarshaling logic. Built-in gadgets under pkg/gadgets/ are not affected.
35. v0.34.0 Nov 4, 2024 · release notes

    Inspektor Gadget v0.34.0 adds headless Kubernetes mode, OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools.-gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. metrics export, kubeipresolver for image-based gadgets, and container PID enrichment.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.34.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.34.0

    └──▷ TRY IT
    Print build logs while building a gadget image to diagnose compile-time issues during development.
    copy

    $ ig image build --verbose <path>

    • Introduces headless mode for Kubernetes deployments, enabling Inspektor Gadget to run without a dedicated UI/CLI consumer.
    • Adds support for named metric exporters and OTLP-gRPC in the otel-metrics operator, enabling direct export to OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. collectors.
    • Adds kubeipresolver operator for image-based gadgets, enriching network events with Kubernetes endpoint metadata.
    • Enriches container events with container PID, providing an additional identifier for process-level correlation.
    • Protocol name now included in L4 endpoint proto field formatting, improving readability of network event output.

    +3 more show less

    • Image build logs are now printed when using verbose mode (--verbose), aiding gadget development and debugging.
    • Gadgets automatically add annotations based on field types, reducing manual metadata effort for gadget authors.
    • authfile and pull-secret parameters promoted to GlobalParams, making registry authentication available across all commands.

    8 details in Everything

36. v0.33.0 Oct 7, 2024 · release notes

    Inspektor Gadget v0.33.0 adds TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. RTT profiling, mutex tracing, block I/O top, headless gadget execution, and a -f config flag.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.33.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.33.0

    └──▷ TRY IT
    Load gadget runtime configuration from a file instead of passing many flags inline.
    copy

    $ ig run <gadget-image> -f config.yaml

    • New profile_tcprtt gadget profiles TCP round-trip times per connection.
    • New trace_mutex gadget traces mutex lock/unlock events in running processes.
    • New top_blockio gadget shows top block I/O activity, similar to existing top gadgets.
    • Ports trace_fsslower to image-based gadget format for consistent deployment.
    • Introduces GadgetInstanceManager to run gadgets headless (without a terminal/UI).

    +8 more show less

    • Adds -f flag to specify gadget runtime configuration from a file.
    • Adds inspect subcommand to the image command for examining gadget images.
    • Adds --fields flag to CLI operator for adding or removing output fields at runtime.
    • Outputs full file path in top_file gadget instead of a bare filename.
    • Adds eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. verifier debug output when a faulty eBPF gadget fails to load.
    • Adds new fields to fsnotify data source for richer filesystem event data.
    • Adds WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. support for parameters handling and runtime config setting.
    • Supports setting OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. annotations at runtime via the OCI handler operator.

    13 details in Everything

37. v0.32.0 Sep 2, 2024 · release notes

    Inspektor Gadget v0.32.0 adds fsnotify gadget, hex output support, owner enrichment, and image-pull disabling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.32.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.32.0

    • New fsnotify gadget traces calls to inotify() and fanotify() system calls.
    • Adds support for displaying event data in hex format via columns.
    • K8s enrichment now includes OwnerKind and OwnerName fields for traced events.
    • Adds mechanism to disable pulling of image-based gadgets.

    4 details in Everything

38. v0.31.0 Aug 5, 2024 · release notes

    Inspektor Gadget v0.31.0 promotes image-based gadgets to GA, adds new trace/top gadgets, TLS support, config file, and OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. metrics.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.31.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.31.0

    └──▷ TRY IT
    Trace bind() syscalls across all pods in a namespace to detect unexpected port listeners.
    copy

    $ kubectl gadget run ghcr.io/inspektor-gadget/gadget/trace_bind:latest -n my-namespace

    Audit seccomp policy violations across containers to identify syscalls being blocked.
    copy

    $ kubectl gadget run ghcr.io/inspektor-gadget/gadget/audit_seccomp:latest -n my-namespace

    • Promotes image-based gadgets to general availability (no longer experimental).
    • Adds trace_bind gadget for tracing bind system calls.
    • Adds audit_seccomp gadget for auditing seccomp policy violations.
    • Adds top_tcp as an image-based gadget for monitoring top TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections.
    • Ports trace_dns to image-based gadget.

    +16 more show less

    • Adds OpenTelemetry metrics operator (otel-metrics) for image-based gadgets.
    • Adds support for profiler gadgets in the image-based gadget framework.
    • Introduces map iterators for image-based gadgets, enabling top_file to use them instead of legacy toppers.
    • Adds TLS support for ig/gadgetctl gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. connections.
    • Adds configuration file support for ig and ig-k8s.
    • Adds --allowed-gadgets global parameter, replacing the previous --allowed-digests and --allowed-registries flags.
    • Adds option to restrict image-based gadget execution to specific registries.
    • Adds support for specifying multiple public keys for gadget verification.
    • Enriches trace_exec output with current working directory (cwd) field.
    • Adds pcomm (parent process command) field to relevant gadgets.
    • Adds retcode field to trace_tcpconnect output.
    • Adds Docker runtime image digest enrichment for running containers.
    • Adds process metadata enricher to container-collection.
    • Makes UidGidResolver available in image-based gadgets.
    • Improves insecure registry support.
    • Adds combiner operator for merging data across datasources.

    21 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --allowed-digests and --allowed-registries flags are replaced by --allowed-gadgets; existing invocations using those flags will break.
39. v0.30.0 Jul 1, 2024 · release notes

    Inspektor Gadget v0.30 adds initial Wasm gadget support, kernel stack maps for traces, and deterministic image exports

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.30.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.30.0

    • Adds initial Wasm gadget runtime support via --wasm flag or config to load and run gadgets written in WebAssemblyWebAssemblyA binary instruction format that runs in browsers and server runtimes at near-native speed, letting developers compile C, Rust, or other languages into a portable, sandboxed module any compliant host can execute..
    • Enables capturing kernel stack traces in trace-based gadgets (e.g. trace_exec) by exposing the kstack field in output records.
    • Makes ig image export produce deterministic tarballs by sorting entries and normalizing timestamps, enabling reproducible gadget images.

    3 details in Everything

40. v0.29.0 Jun 3, 2024 · release notes

    Inspektor Gadget v0.29.0 adds trace_lsm and trace_ssl gadgets plus image/memory gadget support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.29.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.29.0

    • trace_lsm gadget is added to capture Linux Security Module events.
    • trace_ssl gadget is added to capture SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS traffic.
    • Support running gadgets from files and memory.
    • image list command now supports JSON output.
    • Auto-detect container runtime socket path.

    5 details in Everything

41. v0.28.0 May 6, 2024 · release notes

    Adds --seccomp-profile CLI flag, image import/export commands, USDTUSDTUserspace Statically Defined Tracing probes, a mechanism originating in Solaris and adopted by Linux, that lets a program embed named hook points so debuggers and tracers can attach at runtime with near-zero overhead when idle. and LSM trace support, and signal formatter

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.28.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.28.0

    • cmd: Add --seccomp-profile to specify seccomp profile to apply to Inspektor Gadget by @eiffel-fl in https://github.com/inspektor-gadget/inspektor-gadget/pull/2710
    • cmd: Implement image import and export commands by @mauriciovasquezbernal in https://github.com/inspektor-gadget/inspektor-gadget/pull/2779
    • pkg/uprobetracer: add support for USDT tracepoints by @i-Pear in https://github.com/inspektor-gadget/inspektor-gadget/pull/2655
    • pkg/uprobetracer: support LSM trace points by @i-Pear in https://github.com/inspektor-gadget/inspektor-gadget/pull/2747
    • Add signal formatter by @mauriciovasquezbernal in https://github.com/inspektor-gadget/inspektor-gadget/pull/2630

    5 details in Everything

42. v0.27.0 Apr 2, 2024 · release notes

    Inspektor Gadget v0.27.0 adds uprobe/uretprobe support to ig run, tcploss events to trace_tcpretrans, and new fields to trace_exec.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.27.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.27.0

    • ig run now supports basic uprobe and uretprobe probes
    • trace exec output includes pcomm (parent command) and exe (executable path) fields

    2 details in Everything

43. v0.26.0 Mar 4, 2024 · release notes

    Inspektor Gadget v0.26.0 adds trace_tcp, trace_tcpdrop gadgets, toppers for run/gadgets, and --apparmor flag to deploy

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.26.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.26.0

    • gadgets/run: Add support for toppers
    • Implement top file gadget
    • Add trace_tcp image based gadget
    • Add trace_tcpdrop image based gadget

    4 details in Everything

44. v0.25.0 Feb 5, 2024 · release notes

    Inspektor Gadget v0.25.0 adds trace_sni gadget, TC program support, and upper_layer field for trace exec

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.25.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.25.0

    └──▷ USE IT
    Capture SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. values from network traffic in a cluster for identifying outbound connections to specific domains.
    shell copy

    ig run --all-containers trace_sni

    Inspect the upper protocol layer details alongside exec events for richer forensic context.
    shell copy

    ig trace_exec --columns=pid,exe,upper_layer

    • Adds trace_sni subcommand to the ig run command to capture SNI (Server Name Indication) fields from TLS handshakes
    • Adds support for eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. TC (Traffic Control) programs in gadget development and execution
    • Adds the upper_layer field to trace_exec output for deeper process context

    3 details in Everything

45. v0.24.0 Jan 2, 2024 · release notes

    Inspektor Gadget v0.24.0 adds ig image remove, trace_mount, and trace_signal gadgets plus fentry/fexit/raw_tracepoint support in run

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.24.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.24.0

    └──▷ TRY IT
    Clean up unused gadget images to free disk space
    copy

    $ ig image remove <image-name>

    Monitor all mount operations across the cluster for policy enforcement or auditing
    copy

    $ ig trace_mount

    Capture signal delivery events to debug process behavior or security policies
    copy

    $ ig trace_signal

    • ig image remove command added to delete local gadget images
    • New trace_mount gadget for monitoring mount syscalls
    • New trace_signal gadget for tracing signal handling events
    • run gadget now supports fentry, fexit, and raw_tracepoint eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. program types

    4 details in Everything

46. v0.23.0 Dec 4, 2023 · release notes

    Supports deploying into a custom namespace and introduces gadget pull secrets for image-based gadgets.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.23.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.23.0

    • Adds namespace flag to allow Inspektor Gadget to deploy into a custom namespace
    • Introduces gadget-pull-secret configuration to manage image pulls for image-based gadgets

    2 details in Everything

47. v0.22.0 Nov 2, 2023 · release notes

    Inspektor Gadget v0.22.0 adds support for building and running custom containerized gadgets as OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. images

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.22.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.22.0

    └──▷ USE IT
    Run a custom gadget packaged as an OCI image with specific pull policy
    shell copy

    ig run --oci-image myregistry.com/mygadget:latest --pull IfNotPresent

    • New --pull flag on ig run to control OCI image pull policy
    • New --insecure flag on ig run for insecure registry connections

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !BCC-based gadgets are removed; users must use an older Inspektor Gadget version to run them
48. v0.21.0 Oct 2, 2023 · release notes

    Inspektor Gadget v0.21.0 adds ig daemon mode and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support to snapshot socket

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.21.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.21.0

    • Adds daemon subcommand to ig CLI to run the gadget service in the background.
    • Enables CO-RE (Compile Once, Run Everywhere) as the default BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. backend for gadgets.
    • Adds IPv6 address resolution to the snapshot socket gadget output.
    • Permits deploying the legacy bcc flavor via a new cmd flag.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default BPF backend is now core; the previous default bcc must be explicitly selected if required.
49. v0.20.0 Sep 4, 2023 · release notes

    Inspektor Gadget v0.20.0 adds containerized gadget management commands and trace.exec failure tracing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.20.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.20.0

    • Adds ig image build, push, pull, list, and tag subcommands to manage containerized gadgets
    • Adds tracing of failed exec calls (error code field) to the trace exec gadget

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Drop support for CRI v1alpha2; installations using CRI v1alpha2 will fail to operate
50. v0.19.0 Aug 7, 2023 · release notes

    Inspektor Gadget v0.19.0 adds JSON output to gadgets/run, user-space histograms to prometheus gadget, and port filtering to profile tcprtt

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.19.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.19.0

    └──▷ USE IT
    Export gadget execution events as JSON for downstream processing or logging.
    shell copy

    ig gadgets run --output json /path/to/gadget

    Run the gadget using a non-standard runc binary by setting the runtime path.
    shell copy

    IG_RUNTIME_PATH=/usr/local/bin/runc ig gadgets run ...

    Filter trace events in profile tcprtt by specific destination ports.
    shell copy

    ig profile tcprtt --port-filter '80,443'

    • Add env variable to specificy runc/runtime path

    1 detail in Everything

51. v0.17.0 Jun 5, 2023 · release notes

    New profile tcprtt gadget, crun/podman support, and user-space Prometheus metrics.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.17.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.17.0

    • Prometheus: Implement metrics collection in user space
    • Allow hiding columns based on selected features / parameters

    2 details in Everything

52. v0.16.0 May 2, 2023 · release notes

    Inspektor Gadget v0.16.0 adds bpftrace support, trace/tcpdrop and tcpdrop gadgets, new output formats, and socket enrichment improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.16.0

    • Adds bpftrace gadget support for eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. scripting via the CLI
    • Adds ig trace tcpdrop gadget to monitor dropped TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. packets
    • Adds ig tcpretrans gadget to monitor TCP retransmissions
    • Adds --output=yaml,jsonpretty flags to ig and kubectl-gadget commands for structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed.
    • Extends ig snapshot process with pstree-like hierarchical output and user information

    +2 more show less

    • Improves socket enricher to distinguish active and passive sockets
    • Adds latency information to the existing ig trace tcpconnect gadget

    7 details in Everything

53. v0.15.0 Apr 3, 2023 · release notes

    Inspektor Gadget v0.15.0 adds metadata to gadgets and publishes CI benchmark graphs for performance comparison.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.15.0

    • Adds metadata support making gadgets self-contained with operators and interfaces
    • Publishes gadget benchmark graphs in CI to track performance trends across releases
    • Adds NumAnswers and Addresses fields to DNS trace events for richer network context

    3 details in Everything

54. v0.14.0 Mar 6, 2023 · release notes

    Inspektor Gadget v0.14.0 introduces the ig CLI, new trace/fields, top/ebpf stats, and ephemeral container support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.14.0

    • local-gadget is renamed to ig, changing the binary name for all commands.
    • The trace capabilities gadget now includes a syscall column in its output.
    • The trace capabilities gadget adds new fields to its event data structure.
    • Inspektor Gadget now supports ephemeral containers for target selection in gadgets like container-collection.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The local-gadget binary is removed; users must upgrade to use ig instead.
55. v0.13.0 Feb 8, 2023 · release notes

    Adds network-graph trace gadget to local-gadget, nanosecond timestamps for gadgets, and --timeout flag for local-gadget.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.13.0

    • local-gadget: Adds the network-graph trace gadget to visualize network connections between pods and processes
    • Adds global flag --timeout to cmd/local-gadget to control command execution duration
    • Events from all gadgets now include timestamps with nano-precision for higher temporal accuracy
    • DNS trace gadget now includes a latency field to measure response times
    • process metadata is added to events in networking gadgets to link network activity to specific processes

    +1 more show less

    • cmd/top gadget outputs JSON Arrays instead of single JSON objects for easier programmatic consumption

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !cmd/local-gadget removes the interactive mode that was previously available.
    • !OutputModeColumns is removed from cmd/snapshot.
56. v0.12.0 Jan 2, 2023 · release notes

    Inspektor Gadget v0.12.0 adds --node-selector to deploy, traces CRI-O events via fanotify, and enables seccomp/top/profile gadgets in local-gadget

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.12.0

    • Adds --node-selector flag to cmd/deploy to target specific nodes during deployment
    • Enables tracing of cri-o container events when using the fanotify collector
    • New advise seccomp-profile subcommand in local-gadget to generate seccomp profiles
    • Allows use of all gadgets from the profile and top categories in local-gadget
    • Adds tracing of container deletion events in local-gadget

    +1 more show less

    • Adds parent_pid field to snapshot process output via pkg/gadgets update

    6 details in Everything

57. v0.11.0 Dec 5, 2022 · release notes

    Inspektor Gadget v0.11.0 adds local-gadget commands for trace open, fsslower, dns, sni, audit seccomp and trace mount

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.11.0

    • local-gadget adds trace open gadget to trace file operations.
    • local-gadget adds trace fsslower gadget to trace slow file system operations.
    • local-gadget adds trace dns gadget to get information about DNS network connections.
    • local-gadget adds trace sni gadget to get information about SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. network connections.
    • local-gadget adds audit seccomp gadget to audit seccomp profiles attached to containers.

    +1 more show less

    • local-gadget now supports tracing mount operations via trace mount.

    6 details in Everything

58. v0.10.0 Nov 9, 2022 · release notes

    Inspektor Gadget v0.10.0 adds --unique flag to capabilities gadget and column template support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.10.0

    • local-gadget now supports tracing container capabilities usage, OOMOOMAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. events, and sent signals.
    • Add --unique flag to the capabilities gadget to show only unique capability invocations.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !capabilities gadget output no longer includes the CAP_ prefix for capability names (e.g., CAP_SYS_ADMINCAP_SYS_ADMINA Linux capability that grants a process a broad set of privileged operations — mounting filesystems, managing namespaces, and more — without full root, letting cyber tools perform system-level tasks under tighter privilege boundaries. is now SYS_ADMIN).
59. v0.9.0 Oct 4, 2022 · release notes

    Inspektor Gadget v0.9.0 adds trace tcpconnect and tcp to local-gadget with new print library for supported gadgets

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.9.0

    • Introduces a new event printing library available for trace bind, capabilities, dns, exec, signal, and tcp gadgets

    1 detail in Everything

60. v0.8.0 Sep 6, 2022 · release notes

    Inspektor Gadget v0.8.0 adds cumulative fields and map info to top ebpf, refactors local-gadget

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.8.0

    • Adds cumulative fields to top ebpf gadget for aggregated metrics
    • Adds referenced maps information to top ebpf gadget

    2 details in Everything

61. v0.7.1 Aug 3, 2022 · release notes

    Inspektor Gadget v0.7.1 adds the new top ebpf gadget for eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic.-based top command

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.1 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.7.1

62. v0.7.0 Aug 1, 2022 · release notes

    v0.7.0 adds arm64 support, the trace network gadget, non-interactive local-gadget, and simplifies cluster deployment.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.7.0

    └──▷ USE IT
    Deploy Inspektor Gadget to a cluster without piping to kubectl.
    shell copy

    kubectl gadget deploy

    • Adds arm64 architecture support for running Inspektor Gadget on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.-based nodes.
    • Introduces the new trace network gadget to capture and visualize network connections.
    • Simplifies cluster deployment by making kubectl gadget deploy standalone (no longer requires piping to kubectl apply -f -).
    • Adds ID and Runtime information fields to the output of local-gadget list-containers.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !kubectl gadget deploy no longer outputs a Kubernetes manifest suitable for piping to kubectl apply; it now handles deployment directly, so removing the | kubectl apply -f - pipeline is required to avoid errors on upgrade.
63. v0.6.0 Jun 30, 2022 · release notes

    Inspektor Gadget v0.6.0 adds CO-RE support to profile and trace gadgets

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.6.0

    • Adds CO-RE support for profile cpu, trace tcp, profile block-io, and trace capabilities gadgets.
    • Expands namespace selector in kubectl gadget to support multiple namespaces.

    2 details in Everything

64. v0.5.1 Jun 2, 2022 · release notes

    Inspektor Gadget v0.5.1 adds Containerd and CRI-O support to local-gadget and timeout parameter

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.1 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.5.1

    └──▷ USE IT
    Run local-gadget with containerd runtime.
    shell copy

    local-gadget run --runtime containerd

    Limit gadget operation duration with the new timeout parameter.
    shell copy

    gadget run <gadget> --timeout 10s

    • Adds containerd and cri-o runtimes to the local-gadget command
    • Implements a timeout parameter for gadget operations

    2 details in Everything

65. v0.5.0 Apr 21, 2022 · release notes

    Inspektor Gadget v0.5.0 adds six new gadgets and porting key tracing commands to native Go

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.5.0

    • Adds kubectl gadget audit seccomp command to trace syscalls sent to the audit log
    • Adds kubectl gadget trace signal command to trace signals received by processes
    • Adds kubectl gadget trace sni command to trace Server Name Indication requests
    • Adds kubectl gadget top file command to trace reads and writes by file
    • Adds kubectl gadget trace oomkill command to trace when OOMOOMAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. killer is triggered and kills a process

    +2 more show less

    • Adds kubectl gadget trace fsslower command to trace open, read, write and fsync operations slower than a threshold
    • Adds kubectl gadget undeploy command to remove older Inspektor Gadget deployments

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Inspektor Gadget no longer deploys in the kube-system namespace by default; it now uses a separate namespace with RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., which may cause conflicts if an older version is not removed first
    • !The tools-mode flag has been removed
66. v0.4.2 Dec 10, 2021 · release notes

    Inspektor Gadget v0.4.2 adds CLI for seccomp policy advisor and BTFGen integration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.2 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.4.2

    • Integrates with BTFGen for extended compatibility with older kernels

    1 detail in Everything

67. v0.4.0 Nov 18, 2021 · release notes

    Inspektor Gadget v0.4.0 adds local-gadget mode and mountsnoop, plus output/columns flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.4.0

    • Adds local-gadget mode to use Inspektor Gadget without a Kubernetes cluster
    • Adds mountsnoop gadget to trace mount() and umount() syscalls
    • Implements the --output flag for controlling gadget output format
    • Implements the columns parameter for customizing gadget output fields

    4 details in Everything

68. v0.3.1 Oct 6, 2021 · release notes

    Adds biotop gadget for block device I/O tracing and Seccomp profile generation for terminated pods

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.1 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.3.1

    • biotop: traces block device I/O top
    • Generate Seccomp profile for terminated pods
    • fanotify mode supports initial containers and container termination

    3 details in Everything

69. v0.3.0 Sep 15, 2021 · release notes

    Inspektor Gadget v0.3.0 introduces five new gadgets and programmatic Trace CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. control

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.3.0

    • Adds DNS gadget to capture DNS requests
    • Adds process-collector gadget to gather information about currently running processes
    • Adds socket-collector gadget to gather information about currently open TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. and UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. sockets
    • Adds Seccomp Policy Advisor gadget that generates seccomp policies based on captured syscalls with Kubernetes Security Profiles Operator integration (CRD only)
    • Adds biolatency gadget as a wrapper for the BCC biolatency tool (CRD only)

    +4 more show less

    • Enables JSON output for BCC tools using the --json flag
    • Adds support for arm64 on both Linux and Darwin
    • Adds fanotify hook mode to allow capturing container creation from the very beginning
    • Adds programmatic trace control through a new Trace CRD

    9 details in Everything

70. v0.2.0 Jul 1, 2020 · release notes

    Inspektor Gadget v0.2.0 adds --containername filter and containerd support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.2.0

    • Adds --containername flag to bcc tools for filtering by container name
    • Adds support for the containerd runtime

    2 details in Everything

71. v0.1.0 May 27, 2020 · release notes

    Adds OSX builds, OpenShift support, ldpreload runc hook mode, mount namespace filtering, and a flag to disable traceloop.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.0 https://github.com/inspektor-gadget/inspektor-gadget.git
    # already have the repo? check out this version:
    $ git checkout v0.1.0

    • Adds --disable-traceloop flag to disable the traceloop feature
    • Adds OpenShift platform support via PR #76
    • Introduces ldpreload runc hook mode for other distributions via PR #58
    • Adds OSX builds for macOS platforms

    4 details in Everything