https://cybertoolchain.io/tools/inspektor-gadget New releases and features in Inspektor Gadget, tracked by The Cyber Toolchain. en Mon, 05 Oct 2026 18:06:17 GMT https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.57.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.57.0 Mon, 05 Oct 2026 18:06:17 GMT Inspektor Gadget v0.57.0 adds rootless `ig run`, `ig image prune`, and `--drop-cap-sys-admin` for reduced-privilege Kubernetes deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--drop-cap-sys-admin` flag to `kubectl-gadget deploy` to drop `CAP_SYS_ADMIN` and rely on `CAP_BPF` and `CAP_PERFMON` instead, disabling fanotify-based container detection and switching to a non-fanotify hook mode (`podinformer`/`nri`/`crio`).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `ig image prune` command to reclaim blob disk space from unreferenced manifests in the local OCI store. • Enables rootless `ig run` requiring only `cap_bpf`, `cap_perfmon`, and `cap_sys_ptrace` — without `CAP_SYS_ADMIN`; falls back to reporting events from already-running containers when fanotify-based enrichment is unavailable. • Prunes unreferenced manifests from the local store's `index.json` automatically after pulls, builds, and removals, preventing unbounded index growth. • Improves `advise_networkpolicy` to exclude peers that cannot be reliably mapped to a pod (e.g. host-network pods) from generated rules and annotates them instead of producing incorrect policies. Breaking changes: • `snapshot_socket` now reports socket state as a human-readable string (e.g. `ESTABLISHED`, `LISTEN`) instead of a raw numeric enum — any downstream parsing of the numeric value will break. • `top_process` renamed its CPU and Memory fields to shorter names — pipelines or scripts referencing the old field names will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.56.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.56.0 Mon, 07 Sep 2026 14:15:38 GMT Inspektor Gadget v0.56.0 adds Kubernetes multi-tenancy (RBAC-enforced), rootless `ig image` commands, and uprobe support for stripped Go binaries. • Adds `--oci-store-user` flag to `sudo ig run` to read gadgets from the per-user OCI store at `~/.ig/oci-store` (built rootlessly) without creating root-owned files in the user home directory. • Adds experimental Kubernetes multi-tenancy mode: authenticates every `kubectl-gadget` request via `TokenReview` and restricts gadgets to RBAC-authorized namespaces using `SubjectAccessReview`, enforced in the gadget service via KubeManager. • Enables `ig image build`, `ig image list`, `ig image inspect`, `ig image push`, and `ig image pull` to run as a normal (non-root) user against a per-user OCI store at `~/.ig/oci-store`. • Extends `uprobetracer` to fall back to Go's `.gopclntab` section (including the Go 1.26+ `.go.module` format) when the ELF symbol table is absent, enabling uprobes on stripped Go binaries such as a production kubelet. • Switches container runtime socket auto-detection to use the kubelet's `/configz` endpoint over HTTPS, requiring only the `nodes/configz` RBAC permission instead of the broader `nodes/proxy` (Kubernetes v1.33+; earlier clusters fall back to the configured socket path). • Reports network namespace in the `trace_mount` gadget output. Breaking changes: • Kubernetes deployments on v1.33+ now require the `nodes/configz` RBAC permission instead of `nodes/proxy`; clusters that granted only `nodes/proxy` must update their RBAC rules. • `ig image build`, `list`, `inspect`, `push`, and `pull` now use a per-user OCI store at `~/.ig/oci-store` instead of a root-owned store; gadgets previously built into the root store will not be visible to rootless `ig image` commands. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.55.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.55.0 Mon, 03 Aug 2026 16:32:00 GMT Inspektor Gadget v0.55.0 adds a gpu-ebpf-bridge daemon for GPU telemetry, map pinning, non-destructive map iteration, and three new eBPF program types. • eBPF operator now supports map pinning via `LIBBPF_PIN_BY_NAME` in gadget maps and non-destructive map iteration via `iter/bpf_map_elem` with `GADGET_ITER_TARGET_MAP`. • Adds support for `ebpf.SockOps`, `ebpf.SkSKB`, and `ebpf.SkMsg` eBPF program types in the eBPF operator. • Enables OTel/Python stack symbolization for `perf_event`-based gadgets (e.g. `profile_cpu`), including aggregation of identical stacks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.54.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.54.0 Mon, 06 Jul 2026 18:10:52 GMT Inspektor Gadget v0.54.0 adds Cilium NetworkPolicy generation, Helm resource limits, and improved exec arg capture. • Adds `--policy-format cilium` option to `advise_networkpolicy`, enabling generation of Cilium `NetworkPolicy` resources in addition to the existing Kubernetes `NetworkPolicy` output. • Enables CPU and memory `requests` and `limits` for the Inspektor Gadget DaemonSet via the Helm chart `resources` field, so deployments fit within cluster resource quotas. • Improves `trace_exec` to read process arguments from the new process address space, capturing more accurate argv data for executed processes. • Adds support for profile names in OpenTelemetry profiles (`otel-profiles`). • Introduces a user-provided BTF cache in the eBPF subsystem (ebpf v0.22.0 upgrade), reducing repeated BTF processing overhead at scale. Breaking changes: • SBOMs are removed from the image index and signed separately, which may break workflows that retrieve SBOMs directly from the image index. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.53.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.53.0 Mon, 01 Jun 2026 16:35:02 GMT Inspektor Gadget v0.53.0 adds trace_link gadget, Python 3.13 TLS profiling support, and cleaner ustack symbol output. • Adds new `trace_link` gadget for tracing BPF link operations. • Supports Python 3.13 TLS in the eBPF-based continuous profiler via updated otel-ebpf-profiler. • Improves user-space stack (`ustack`) symbol display: removes `[N]` index prefix and shows binary path with offset instead. • Adds `--tls-insecure` flag to `ig daemon` for insecure TLS connections. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.51.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.51.0 Tue, 07 Apr 2026 11:02:28 GMT Inspektor Gadget v0.51.0 adds CUDA profiling/memory gadgets, CFS throttle detection, and a new logs operator. • New `profile_cuda` gadget for profiling CUDA GPU workloads with eBPF. • New `top_cpu_throttle` gadget to detect and surface CFS bandwidth throttling per container/process. • New CUDA memory metrics gadget for tracking GPU memory usage. • Introduces a `logs` operator enabling log-stream integration within the gadget pipeline. • Helm chart now supports configuring `hostPID` and `hostNetwork` for the DaemonSet. • Network policy generator operator (`op/generate_networkpolicy`) now uses `podSelector` for Services, improving generated policy accuracy. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.50.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.50.0 Mon, 02 Mar 2026 09:48:30 GMT Inspektor Gadget v0.50.0 adds a kernel module tracing gadget and container image digest filtering. • New `trace_init_module` gadget to trace kernel module loading events. • Supports filtering container collection by image digests. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.49.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.49.0 Mon, 02 Feb 2026 14:50:45 GMT Inspektor Gadget v0.49.0 adds OpenTelemetry profiles export and a new `--gadgets-only` flag for bpfstats. • Adds OpenTelemetry profiles support to exporters, enabling profiling data to be shipped via the OTel pipeline. • New `--gadgets-only` flag for the `bpfstats` gadget filters output to show only Inspektor Gadget eBPF programs instead of all eBPF programs. Breaking changes: • The `--all` flag for the `bpfstats` gadget has been removed; showing all eBPF programs is now the default behavior. To restore the previous behavior of showing only gadget programs, pass `--gadgets-only`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.48.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.48.0 Mon, 05 Jan 2026 16:31:23 GMT Inspektor Gadget v0.48.0 adds a Snapshot File gadget, container selector exclusions, and a new from_rootfs field in trace_exec. • New `snapshot-file` gadget captures a point-in-time view of open files across processes. • Supports exclusion filters and multiple values in container selectors, enabling finer-grained gadget targeting. • Adds `from_rootfs` field to `trace_exec` gadget to indicate whether an executed binary originates from the container root filesystem. • Enables `clear-screen-before` display mode for profile gadgets in the CLI, giving cleaner live output. • Helm charts now include Kubernetes recommended labels by default, improving resource discoverability and compatibility with standard tooling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.47.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.47.0 Mon, 01 Dec 2025 08:13:10 GMT Inspektor Gadget v0.47.0 adds image verification, cosign bundle support, symlink-resolved file paths in trace_open, and stdin manifest apply. • Adds `ig image verify` command to verify gadget image signatures from the CLI. • Supports cosign bundle format for gadget image signature verification. • Adds resolved file path (after symlink resolution) to `trace_open` events. • Allows `-f -` to apply a gadget manifest from stdin. • Adds `metricname` annotation support to the otel-metrics operator for custom metric naming. • Appends sort fields when the same datasource is specified multiple times in the sort operator. Breaking changes: • The otel-metrics operator now defaults `metricname` to `FullName` instead of the previous default, which may change metric names in existing dashboards or alerting rules on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.46.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.46.0 Mon, 03 Nov 2025 13:16:53 GMT Inspektor Gadget v0.46.0 adds gadget instance status support and MicroK8s runc path detection. • Adds instance status support to gadget-service, enabling visibility into the state of running gadget instances. • Adds runc path detection for MicroK8s environments, enabling Inspektor Gadget to work on MicroK8s clusters. • Adds `gadget_socket_lookup_with_direction` helper to the eBPF include headers for gadget authors. • Supports OCI 1.1 method for retrieving cosign signatures alongside the legacy `.sig` tag approach. • Adds Puller and Exporter interfaces for both cosign legacy `.sig` tag and OCI 1.1 signature retrieval. • Enables notation signature verification using a local store. • Renames snapshotters to iters and makes them repeatable, enabling periodic re-execution of snapshot-style gadgets. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.45.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.45.0 Mon, 06 Oct 2025 08:07:12 GMT Inspektor Gadget v0.45.0 adds a new tcpdump gadget with generic packet filters, PIE symbolization, and Notation signature verification. • Introduces generic packet filters and a new `tcpdump` gadget for packet-level capture and filtering via eBPF. • Adds PIE (Position Independent Executable) support in the symbolizer, enabling accurate user-space stack symbolization for PIE binaries. • Adds Notation-based signature verification for gadget artifacts alongside the existing Cosign support. • Supports runtime/Kubernetes filtering in localmanager and kubemanager, enabling more granular gadget targeting. • Adds a `buildid` field to `ustack` output to support client-side symbolization workflows. Breaking changes: • The `undeploy` command removes legacy logic for deleting old IG deployments — clusters with older Inspektor Gadget deployments may not be cleaned up correctly on upgrade. • In the `trace_exec` gadget, arguments are now joined with a non-breaking space (nbsp) instead of a regular space, which may break parsers or scripts that split on whitespace. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.44.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.44.0 Mon, 01 Sep 2025 17:19:54 GMT Inspektor Gadget v0.44.0 adds ttysnoop gadget, human-readable open-mode/flag formatters, and custom OCI gadget parameters. • New `ttysnoop` gadget for snooping on TTY/terminal activity. • Adds built-in formatters for `mode` and `flags` fields in `trace_open`, surfacing human-readable permission and flag strings instead of raw integers. • Enables gadget authors to define custom parameters directly in `gadget.yaml` for OCI-packaged gadgets. • Adds `count` annotation/parameter to `top_process` gadget for controlling the number of displayed processes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.43.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.43.0 Mon, 04 Aug 2025 09:40:47 GMT Inspektor Gadget v0.43.0 adds Helm imagePullSecrets support, Expr-based filter expressions, and traceloop socket parsing. • Adds Helm `imagePullSecrets` support for the DaemonSet image, enabling deployments from private registries. • Introduces filter expressions based on the Expr language in the filter operator, enabling richer, programmable event filtering. • Traceloop displays wider parameters column, improving readability of syscall arguments. • `kubectl-gadget undeploy` no longer removes the namespace, preventing accidental deletion of shared namespaces on uninstall. • Makes the default OCI registry URL for image-based gadgets configurable at build time. • Updates vmlinux.h to Linux 6.15.5, extending eBPF CO-RE support for the latest kernel. Breaking changes: • `kubectl-gadget undeploy` removes known resources from versions prior to v0.43.0, which may alter cleanup behavior when upgrading from older deployments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.42.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.42.0 Mon, 07 Jul 2025 12:09:57 GMT Inspektor Gadget v0.42.0 adds Rust WASM bindings, removes built-in gadgets, and expands trace_tcp, image, and deploy capabilities. • Adds Rust WASM bindings, enabling gadget authors to write gadgets in Rust targeting the WASM API. • Adds `accept-only` parameter to `trace_tcp` to filter captured events to accepted connections only. • Adds `tty` field to process/exec event data. • Allows gadgets to specify default values for parameters in their metadata. • Adds support for a config file in the `deploy` command. • Supports extra environment variables for the DaemonSet via Helm charts. • Handles gadget signatures during `image export` and `image import` operations. • Adds JSON output mode to the `image import` command. • Adds a default gadget namespace to Helm charts. • Introduces `PreCreateContainer` events in the container hook lifecycle. • Sets visibility controls on formatted/derived columns. • Provides human-readable format for bytes and duration fields in `bpfstats` and `top_process`. • Uses CO-RE in socketenricher, making it resilient to kernel struct layout changes. • Caches gadget OCI signatures via ORAS to speed up repeated pulls. Breaking changes: • All built-in gadgets have been removed treewide; gadgets must now be referenced as OCI images. • Deprecated environment variables in `gadgettracermanager` have been removed; configs must be migrated to the supported config file. • Support for torcx has been removed; environments relying on torcx for container runtime integration will no longer work. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.40.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.40.0 Mon, 05 May 2025 21:07:42 GMT Inspektor Gadget v0.40.0 adds a bpfstats gadget, image-based advise_seccomp, inspect command for kubectl-gadget, and WASM caching. • New `bpfstats` gadget for inspecting eBPF program statistics. • Implements `advise_seccomp` as an image-based gadget. • Adds `inspect` command to `kubectl-gadget` with OCI metadata, mermaid graphs, and eBPF relocation details. • WASM operator now uses a cache to significantly speed up gadget execution. • Adds `ls` and `rm` aliases for `ig image list` and `ig image remove`. • Adds `--builder-image-pull` flag to `ig image build` to control builder image pull behavior. • Introduces `value.one-of` annotation for gadget parameter validation. • Adds generic `collect-ustack` parameter and templates for user-space stack collection. • KubeNameResolver now supports image-based gadgets. • Adds Kubernetes recommended labels to Helm chart resources. Breaking changes: • The `ebpf-builder` image is renamed to `gadget-builder`; any references to `ebpf-builder` in build scripts or configs must be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.39.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.39.0 Mon, 07 Apr 2025 08:31:17 GMT Inspektor Gadget v0.39.0 adds user stacks to audit_seccomp and trace_open, converts traceloop to image-based gadget, and expands inspect capabilities. • Converts `traceloop` to an image-based gadget, aligning it with the modern gadget distribution model. • Adds user-space stack capture to `gadget audit_seccomp` via the collect-ustack parameter. • Adds user-space stack capture to `gadget trace_open` via the collect-ustack parameter. • Adds `--symbolizers` parameter to user-stack (`ustack`) resolution for controlling symbol resolution backends. • Extends `inspect` command with eBPF and WASM extra info display. • Makes `inspect` pull policy and image verification configurable via new flags. • Adds uniform filtering support for networking gadgets. • Adds support for Linux 5.4 in the `fsnotify` gadget. • Updates syscall table to Linux v6.13.0. • Renames stack-collection gadget params from `print-*stack` to `collect-*stack`. • WASM gadget layer switches from TinyGo to Go 1.24, enabling full Go standard library support in WASM gadgets. Breaking changes: • Gadget stack parameters are renamed from `print-*stack` to `collect-*stack`; existing scripts or workflows using the old parameter names will break. • WASM module name changed from `env` to `ig`; WASM gadgets referencing the `env` module name must be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.38.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.38.0 Mon, 03 Mar 2025 14:33:49 GMT Inspektor Gadget v0.38.0 adds user stack traces, a qdisc latency profiler, DNS-over-TCP tracing, and a new env-var field operator. • Adds initial support for user-space stack traces in eBPF gadgets. • New `qdisc_latency` tracer gadget profiles network queuing discipline latency. • Supports DNS tracing over TCP (without packet reassembly) in `trace_dns`. • New `env` operator enables creating new data fields from environment variables in gadget pipelines. • Adds getSyscallID() WASM host function to look up a syscall ID by name from guest gadgets. • Expands `trace_capabilities` gadget support to Linux kernels older than 6.1. • Allows overriding OpenTelemetry export key/name via the `otel` operator. • Warns the user when a gadget is run against a mismatched Inspektor Gadget version. • Displays fsnotify external API masks as human-readable strings instead of raw integers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.37.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.37.0 Mon, 03 Feb 2025 11:23:15 GMT Inspektor Gadget v0.37.0 adds execveat tracing, failed-connection filtering, richer exec fields, and expanded WASM APIs • Adds `execveat` syscall support to trace_exec gadgets, covering exec-via-file-descriptor paths missed by `execve` alone. • Merges `trace_tcpconnect` into `trace_tcp`, unifying TCP connection tracing under a single gadget. • Adds `--failed-only` option to `trace_tcp` to surface only failed TCP connections. • Adds `dev`, `inode`, and `fupper_layer` fields to `trace_exec` for identifying executed file identity and overlay-filesystem layer. • Adds `ptid` (parent thread ID) field to `trace_exec` events. • Adds `exepath` to `trace_exec` output even when execution fails. • Adds additional DNS metadata fields to DNS trace output. • Provides human-readable representations of bytes and time durations in gadget output. • Adds `fd` field to `trace_tcp` events. • Adds WASM API functions to get syscall names and declarations from gadgets. • Adds WASM API support for array and hash map types. • Adds WASM API functions to interact with perf buffers. • Adds `kallsymsSymbolExists` WASM helper for runtime kernel symbol checks. • Allows escaping commas in filter expressions, enabling filtering on values that contain commas. • Adds support for non-`unix://`-prefixed socket paths in container runtime configuration. • Returns client version from `kubectl-gadget` even when the server is unreachable. Breaking changes: • `trace_tcpconnect` is merged into `trace_tcp`; any scripts or workflows invoking `trace_tcpconnect` as a standalone gadget will need to switch to `trace_tcp`. • Built-in gadgets are deprecated tree-wide; existing setups relying on built-in gadgets should migrate to image-based gadgets. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.36.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.36.0 Mon, 06 Jan 2025 09:18:37 GMT Inspektor Gadget v0.36.0 adds OpenTelemetry logs export, richer DNS/exec tracing fields, and uniform gadget filtering. • Adds OpenTelemetry logs (otel-logs) support for exporting gadget output to OTel-compatible backends. • Adds `cwd` and `exepath` fields to `trace_dns` via the `--paths` flag for richer process context on DNS events. • Adds `file` field to `trace exec` to capture the interpreter path for script executions. • Introduces uniform filtering across gadgets for consistent field-based event filtering. • Allows configuring otel-metrics via Helm charts for Kubernetes deployments. • Enforces unique instance names in `kubectl-gadget`, preventing duplicate named gadget instances. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.35.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.35.0 Mon, 02 Dec 2024 10:14:52 GMT Inspektor Gadget v0.35.0 adds deadlock detection, a new fdpass gadget, WASM map APIs, and TID/exepath fields. • New `fdpass` gadget traces file-descriptor passing between processes. • New `deadlock` gadget detects deadlocks by finding cycles in mutex wait directed graphs, with PID-based filtering and dead-process handling. • Adds WASM API functions to create, close, and manipulate eBPF maps from WASM gadgets. • Adds `Unreference` (formerly `SetRequested`) and `AddTags` methods to the WASM API for datasource and field accessor control. • Enhances `version` command output with JSON format support. • Adds Thread ID (TID) field to `execsnoop` and `open` gadgets. • Adds `exepath` field to the `trace_exec` image-based gadget. • Expands exec argument capture to support up to 256 bytes per argument. • Monitoring tooling now uses an OpenTelemetry metrics exporter. Breaking changes: • JSON output for image-based gadgets now nests process-related fields (`comm`, `pid`, `tid`, `uid`, `gid`, `pcomm`, `mntns_id`) under a `proc` leaf node; consumers must update their unmarshaling logic. Built-in gadgets under `pkg/gadgets/` are not affected. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.34.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.34.0 Mon, 04 Nov 2024 17:16:07 GMT Inspektor Gadget v0.34.0 adds headless Kubernetes mode, OTLP-gRPC metrics export, kubeipresolver for image-based gadgets, and container PID enrichment. • Introduces headless mode for Kubernetes deployments, enabling Inspektor Gadget to run without a dedicated UI/CLI consumer. • Adds support for named metric exporters and OTLP-gRPC in the otel-metrics operator, enabling direct export to OpenTelemetry collectors. • Adds kubeipresolver operator for image-based gadgets, enriching network events with Kubernetes endpoint metadata. • Enriches container events with container PID, providing an additional identifier for process-level correlation. • Protocol name now included in L4 endpoint proto field formatting, improving readability of network event output. • Image build logs are now printed when using verbose mode (`--verbose`), aiding gadget development and debugging. • Gadgets automatically add annotations based on field types, reducing manual metadata effort for gadget authors. • `authfile` and `pull-secret` parameters promoted to GlobalParams, making registry authentication available across all commands. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.33.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.33.0 Mon, 07 Oct 2024 08:21:33 GMT Inspektor Gadget v0.33.0 adds TCP RTT profiling, mutex tracing, block I/O top, headless gadget execution, and a -f config flag. • New `profile_tcprtt` gadget profiles TCP round-trip times per connection. • New `trace_mutex` gadget traces mutex lock/unlock events in running processes. • New `top_blockio` gadget shows top block I/O activity, similar to existing top gadgets. • Ports `trace_fsslower` to image-based gadget format for consistent deployment. • Introduces `GadgetInstanceManager` to run gadgets headless (without a terminal/UI). • Adds `-f` flag to specify gadget runtime configuration from a file. • Adds `inspect` subcommand to the `image` command for examining gadget images. • Adds `--fields` flag to CLI operator for adding or removing output fields at runtime. • Outputs full file path in `top_file` gadget instead of a bare filename. • Adds eBPF verifier debug output when a faulty eBPF gadget fails to load. • Adds new fields to `fsnotify` data source for richer filesystem event data. • Adds WASM support for parameters handling and runtime config setting. • Supports setting OCI annotations at runtime via the OCI handler operator. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.32.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.32.0 Mon, 02 Sep 2024 09:41:33 GMT Inspektor Gadget v0.32.0 adds fsnotify gadget, hex output support, owner enrichment, and image-pull disabling. • New `fsnotify` gadget traces calls to inotify() and fanotify() system calls. • Adds support for displaying event data in hex format via columns. • K8s enrichment now includes `OwnerKind` and `OwnerName` fields for traced events. • Adds mechanism to disable pulling of image-based gadgets. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.31.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.31.0 Mon, 05 Aug 2024 19:15:42 GMT Inspektor Gadget v0.31.0 promotes image-based gadgets to GA, adds new trace/top gadgets, TLS support, config file, and OpenTelemetry metrics. • Promotes image-based gadgets to general availability (no longer experimental). • Adds `trace_bind` gadget for tracing bind system calls. • Adds `audit_seccomp` gadget for auditing seccomp policy violations. • Adds `top_tcp` as an image-based gadget for monitoring top TCP connections. • Ports `trace_dns` to image-based gadget. • Adds OpenTelemetry metrics operator (`otel-metrics`) for image-based gadgets. • Adds support for profiler gadgets in the image-based gadget framework. • Introduces map iterators for image-based gadgets, enabling `top_file` to use them instead of legacy toppers. • Adds TLS support for `ig`/`gadgetctl` gRPC connections. • Adds configuration file support for `ig` and `ig-k8s`. • Adds `--allowed-gadgets` global parameter, replacing the previous `--allowed-digests` and `--allowed-registries` flags. • Adds option to restrict image-based gadget execution to specific registries. • Adds support for specifying multiple public keys for gadget verification. • Enriches `trace_exec` output with current working directory (`cwd`) field. • Adds `pcomm` (parent process command) field to relevant gadgets. • Adds `retcode` field to `trace_tcpconnect` output. • Adds Docker runtime image digest enrichment for running containers. • Adds process metadata enricher to container-collection. • Makes `UidGidResolver` available in image-based gadgets. • Improves insecure registry support. • Adds combiner operator for merging data across datasources. Breaking changes: • The `--allowed-digests` and `--allowed-registries` flags are replaced by `--allowed-gadgets`; existing invocations using those flags will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.30.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.30.0 Mon, 01 Jul 2024 10:33:17 GMT Inspektor Gadget v0.30 adds initial Wasm gadget support, kernel stack maps for traces, and deterministic image exports • Adds initial Wasm gadget runtime support via `--wasm` flag or config to load and run gadgets written in WebAssembly. • Enables capturing kernel stack traces in trace-based gadgets (e.g. `trace_exec`) by exposing the `kstack` field in output records. • Makes `ig image export` produce deterministic tarballs by sorting entries and normalizing timestamps, enabling reproducible gadget images. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.29.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.29.0 Mon, 03 Jun 2024 14:24:47 GMT Inspektor Gadget v0.29.0 adds trace_lsm and trace_ssl gadgets plus image/memory gadget support • `trace_lsm` gadget is added to capture Linux Security Module events. • `trace_ssl` gadget is added to capture SSL/TLS traffic. • Support running gadgets from files and memory. • `image list` command now supports JSON output. • Auto-detect container runtime socket path. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.28.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.28.0 Mon, 06 May 2024 17:43:01 GMT Adds `--seccomp-profile` CLI flag, image import/export commands, USDT and LSM trace support, and signal formatter • `cmd: Add `--seccomp-profile` to specify seccomp profile to apply to Inspektor Gadget by @eiffel-fl in https://github.com/inspektor-gadget/inspektor-gadget/pull/2710` • cmd: Implement image import and export commands by @mauriciovasquezbernal in https://github.com/inspektor-gadget/inspektor-gadget/pull/2779 • pkg/uprobetracer: add support for USDT tracepoints by @i-Pear in https://github.com/inspektor-gadget/inspektor-gadget/pull/2655 • pkg/uprobetracer: support LSM trace points by @i-Pear in https://github.com/inspektor-gadget/inspektor-gadget/pull/2747 • Add signal formatter by @mauriciovasquezbernal in https://github.com/inspektor-gadget/inspektor-gadget/pull/2630 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.27.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.27.0 Tue, 02 Apr 2024 09:47:39 GMT Inspektor Gadget v0.27.0 adds uprobe/uretprobe support to `ig run`, `tcploss` events to `trace_tcpretrans`, and new fields to `trace_exec`. • `ig run` now supports basic uprobe and uretprobe probes • `trace exec` output includes `pcomm` (parent command) and `exe` (executable path) fields Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.26.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.26.0 Mon, 04 Mar 2024 21:44:32 GMT Inspektor Gadget v0.26.0 adds trace_tcp, trace_tcpdrop gadgets, toppers for run/gadgets, and --apparmor flag to deploy • `gadgets/run`: Add support for `toppers` • Implement `top file` gadget • Add `trace_tcp` image based gadget • Add `trace_tcpdrop` image based gadget Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.25.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.25.0 Mon, 05 Feb 2024 03:40:13 GMT Inspektor Gadget v0.25.0 adds trace_sni gadget, TC program support, and upper_layer field for trace exec • Adds `trace_sni` subcommand to the `ig run` command to capture SNI (Server Name Indication) fields from TLS handshakes • Adds support for eBPF TC (Traffic Control) programs in gadget development and execution • Adds the `upper_layer` field to `trace_exec` output for deeper process context Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.24.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.24.0 Tue, 02 Jan 2024 13:10:45 GMT Inspektor Gadget v0.24.0 adds `ig image remove`, `trace_mount`, and `trace_signal` gadgets plus `fentry/fexit/raw_tracepoint` support in `run` • `ig image remove` command added to delete local gadget images • New `trace_mount` gadget for monitoring mount syscalls • New `trace_signal` gadget for tracing signal handling events • `run` gadget now supports `fentry`, `fexit`, and `raw_tracepoint` eBPF program types Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.23.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.23.0 Mon, 04 Dec 2023 16:41:39 GMT Supports deploying into a custom namespace and introduces gadget pull secrets for image-based gadgets. • Adds `namespace` flag to allow Inspektor Gadget to deploy into a custom namespace • Introduces `gadget-pull-secret` configuration to manage image pulls for image-based gadgets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.22.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.22.0 Thu, 02 Nov 2023 16:06:03 GMT Inspektor Gadget v0.22.0 adds support for building and running custom containerized gadgets as OCI images • New `--pull` flag on `ig run` to control OCI image pull policy • New `--insecure` flag on `ig run` for insecure registry connections Breaking changes: • BCC-based gadgets are removed; users must use an older Inspektor Gadget version to run them Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.20.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.20.0 Mon, 04 Sep 2023 10:00:34 GMT Inspektor Gadget v0.20.0 adds containerized gadget management commands and trace.exec failure tracing • Adds `ig image build`, `push`, `pull`, `list`, and `tag` subcommands to manage containerized gadgets • Adds tracing of failed exec calls (error code field) to the `trace exec` gadget Breaking changes: • Drop support for CRI v1alpha2; installations using CRI v1alpha2 will fail to operate Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.19.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.19.0 Mon, 07 Aug 2023 09:33:55 GMT Inspektor Gadget v0.19.0 adds JSON output to gadgets/run, user-space histograms to prometheus gadget, and port filtering to profile tcprtt • Add env variable to specificy runc/runtime path Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.17.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.17.0 Mon, 05 Jun 2023 15:28:41 GMT New `profile tcprtt` gadget, crun/podman support, and user-space Prometheus metrics. • Prometheus: Implement metrics collection in user space • Allow hiding columns based on selected features / parameters Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.16.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.16.0 Tue, 02 May 2023 12:35:54 GMT Inspektor Gadget v0.16.0 adds bpftrace support, trace/tcpdrop and tcpdrop gadgets, new output formats, and socket enrichment improvements. • Adds `bpftrace` gadget support for eBPF scripting via the CLI • Adds `ig trace tcpdrop` gadget to monitor dropped TCP packets • Adds `ig tcpretrans` gadget to monitor TCP retransmissions • Adds `--output=yaml,jsonpretty` flags to `ig` and `kubectl-gadget` commands for structured output • Extends `ig snapshot process` with `pstree`-like hierarchical output and user information • Improves socket enricher to distinguish active and passive sockets • Adds latency information to the existing `ig trace tcpconnect` gadget Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.15.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.15.0 Mon, 03 Apr 2023 13:20:59 GMT Inspektor Gadget v0.15.0 adds metadata to gadgets and publishes CI benchmark graphs for performance comparison. • Adds metadata support making gadgets self-contained with operators and interfaces • Publishes gadget benchmark graphs in CI to track performance trends across releases • Adds `NumAnswers` and `Addresses` fields to DNS trace events for richer network context Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.14.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.14.0 Mon, 06 Mar 2023 16:25:11 GMT Inspektor Gadget v0.14.0 introduces the `ig` CLI, new trace/fields, top/ebpf stats, and ephemeral container support • `local-gadget` is renamed to `ig`, changing the binary name for all commands. • The `trace capabilities` gadget now includes a `syscall` column in its output. • The `trace capabilities` gadget adds new fields to its event data structure. • Inspektor Gadget now supports ephemeral containers for target selection in gadgets like `container-collection`. Breaking changes: • The `local-gadget` binary is removed; users must upgrade to use `ig` instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.12.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.12.0 Mon, 02 Jan 2023 10:49:20 GMT Inspektor Gadget v0.12.0 adds `--node-selector` to `deploy`, traces CRI-O events via fanotify, and enables seccomp/top/profile gadgets in local-gadget • Adds `--node-selector` flag to `cmd/deploy` to target specific nodes during deployment • Enables tracing of `cri-o` container events when using the `fanotify` collector • New `advise seccomp-profile` subcommand in `local-gadget` to generate seccomp profiles • Allows use of all gadgets from the `profile` and `top` categories in `local-gadget` • Adds tracing of container deletion events in `local-gadget` • Adds `parent_pid` field to `snapshot process` output via `pkg/gadgets` update Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.11.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.11.0 Mon, 05 Dec 2022 16:32:48 GMT Inspektor Gadget v0.11.0 adds local-gadget commands for trace open, fsslower, dns, sni, audit seccomp and trace mount • `local-gadget` adds `trace open` gadget to trace file operations. • `local-gadget` adds `trace fsslower` gadget to trace slow file system operations. • `local-gadget` adds `trace dns` gadget to get information about DNS network connections. • `local-gadget` adds `trace sni` gadget to get information about SNI network connections. • `local-gadget` adds `audit seccomp` gadget to audit seccomp profiles attached to containers. • `local-gadget` now supports tracing mount operations via `trace mount`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.10.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.10.0 Wed, 09 Nov 2022 19:11:52 GMT Inspektor Gadget v0.10.0 adds `--unique` flag to capabilities gadget and column template support. • `local-gadget` now supports tracing container capabilities usage, OOM events, and sent signals. • Add `--unique` flag to the `capabilities` gadget to show only unique capability invocations. Breaking changes: • `capabilities` gadget output no longer includes the `CAP_` prefix for capability names (e.g., `CAP_SYS_ADMIN` is now `SYS_ADMIN`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.8.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.8.0 Tue, 06 Sep 2022 16:59:10 GMT Inspektor Gadget v0.8.0 adds cumulative fields and map info to `top ebpf`, refactors local-gadget • Adds cumulative fields to `top ebpf` gadget for aggregated metrics • Adds referenced maps information to `top ebpf` gadget Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.7.1 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.7.1 Wed, 03 Aug 2022 23:19:37 GMT Inspektor Gadget v0.7.1 adds the new `top ebpf` gadget for eBPF-based top command • Adds the new `top ebpf` gadget for eBPF-based top command Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.7.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.7.0 Mon, 01 Aug 2022 16:02:58 GMT v0.7.0 adds arm64 support, the `trace network` gadget, non-interactive local-gadget, and simplifies cluster deployment. • Adds `arm64` architecture support for running Inspektor Gadget on ARM-based nodes. • Introduces the new `trace network` gadget to capture and visualize network connections. • Simplifies cluster deployment by making `kubectl gadget deploy` standalone (no longer requires piping to `kubectl apply -f -`). • Adds `ID` and `Runtime` information fields to the output of `local-gadget list-containers`. Breaking changes: • `kubectl gadget deploy` no longer outputs a Kubernetes manifest suitable for piping to `kubectl apply`; it now handles deployment directly, so removing the `| kubectl apply -f -` pipeline is required to avoid errors on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.6.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.6.0 Thu, 30 Jun 2022 16:28:34 GMT Inspektor Gadget v0.6.0 adds CO-RE support to profile and trace gadgets • Adds CO-RE support for `profile cpu`, `trace tcp`, `profile block-io`, and `trace capabilities` gadgets. • Expands namespace selector in `kubectl gadget` to support multiple namespaces. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.5.1 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.5.1 Thu, 02 Jun 2022 14:29:17 GMT Inspektor Gadget v0.5.1 adds Containerd and CRI-O support to local-gadget and timeout parameter • Adds `containerd` and `cri-o` runtimes to the `local-gadget` command • Implements a `timeout` parameter for gadget operations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.5.0 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.5.0 Thu, 21 Apr 2022 19:01:57 GMT Inspektor Gadget v0.5.0 adds six new gadgets and porting key tracing commands to native Go • Adds `kubectl gadget audit seccomp` command to trace syscalls sent to the audit log • Adds `kubectl gadget trace signal` command to trace signals received by processes • Adds `kubectl gadget trace sni` command to trace Server Name Indication requests • Adds `kubectl gadget top file` command to trace reads and writes by file • Adds `kubectl gadget trace oomkill` command to trace when OOM killer is triggered and kills a process • Adds `kubectl gadget trace fsslower` command to trace open, read, write and fsync operations slower than a threshold • Adds `kubectl gadget undeploy` command to remove older Inspektor Gadget deployments Breaking changes: • Inspektor Gadget no longer deploys in the `kube-system` namespace by default; it now uses a separate namespace with RBAC, which may cause conflicts if an older version is not removed first • The `tools-mode` flag has been removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.4.2 https://github.com/inspektor-gadget/inspektor-gadget/releases/tag/v0.4.2 Fri, 10 Dec 2021 17:18:38 GMT Inspektor Gadget v0.4.2 adds CLI for seccomp policy advisor and BTFGen integration. • Integrates with BTFGen for extended compatibility with older kernels Full history on Cyber Toolchain: https://cybertoolchain.io/tools/inspektor-gadget