Inspektor Gadget

Overview

Inspektor Gadget is a free, open-source toolkit and framework for eBPF-based inspection of Linux hosts and Kubernetes clusters. It is aimed at platform, security, and observability engineers who need kernel-level signals tied to workload context, rather than a packaged dashboard for nontechnical users. The combination is compelling, but adoption depends on kernel compatibility, supported cluster environments, and a willingness to stay on the latest release.

Key features

Its gadgets package eBPF programs as OCI images that can be deployed and run for system inspection. In Kubernetes, deployment as a DaemonSet puts one pod on every cluster node, providing a consistent node-level collection model. This is practical for fleet-wide visibility, although it adds a cluster workload that must be operated and secured.

The project automatically enriches kernel data with higher-level Kubernetes information, including pod and container names. That context makes low-level events more actionable when investigating workload behavior. Data can be exported to observability tools, so Inspektor Gadget can feed an existing monitoring stack instead of requiring a complete replacement.

Extensibility is a central strength. WebAssembly modules can post-process data and customize operators, and a Go library lets developers embed the framework in their own tooling. These capabilities suit teams that want to build specialized workflows; organizations seeking a fixed, turnkey monitoring product may find the framework-oriented approach unnecessarily demanding.

Security features support controlled deployment. Official image-based gadgets are signed with cosign, with documentation for signature verification. The --allowed-gadgets flag restricts runnable gadgets by digest, tag, or image prefix, giving operators a way to enforce an approved image policy.

Pricing

The Inspektor Gadget plan costs free. It includes the open-source tools and framework, with no paid tier or subscription terms stated. This is attractive for teams able to provide their own infrastructure and operational support, but the zero price does not remove the Linux, Kubernetes, maintenance, or engineering commitments.

Platforms

Inspektor Gadget is self-hosted and supports API, Linux, macOS, and Windows. Linux is the execution foundation for project-developed gadgets: kernel 5.10 or later with BTF enabled is required. macOS and Windows are supported as clients through gadgetctl, not as substitutes for the Linux hosts running the eBPF workloads.

The requirements list Minikube, AKS, EKS, GKS, OpenShift, and Talos as supported Kubernetes platforms. AWS Fargate, Azure Container Instances, and GKE Autopilot are marked unsupported, which can rule it out for managed-container architectures built around those services.

Who it's for

Choose Inspektor Gadget when your team needs network visibility, application tracing, or kernel profiling with Kubernetes-aware attribution and can manage self-hosted infrastructure. It is particularly well suited to engineers who value programmable collection and export into an existing observability pipeline.

It is a weaker fit for teams that cannot control host kernels, run on an unsupported serverless platform, or want long-term maintenance branches. The project states that only the latest release receives security updates and maintenance, so upgrade planning is part of normal ownership.

Pros and cons

Pros

• Kubernetes context for eBPF data: pod and container enrichment makes kernel events easier to relate to applications.
• OCI-based gadgets: packaged programs are deployable units that fit image-oriented operations.
• Extensible processing: WebAssembly and Go integration support custom operators and pipelines.
• Deployment controls: cosign verification and allowed-gadget restrictions help govern executable content.
• No license charge: the open-source plan removes subscription cost.

Cons

• Strict host prerequisite: project gadgets require Linux 5.10 or newer with BTF enabled.
• Environment exclusions: AWS Fargate, Azure Container Instances, and GKE Autopilot are unsupported.
• Latest-release-only policy: security and maintenance require keeping up with current releases.
• Self-hosted responsibility: deployment, upgrades, and observability integration remain with the adopting team.

Alternatives

Kubeshark is a better choice when you want a freemium Kubernetes-focused option with a Community plan capped at three nodes or 60 pods, internet connectivity, unlimited API calls, and community support.

DeepFlow suits readers seeking a free, open-source observability option covering Linux servers and selected Kubernetes, cloud, and container environments, with a free trial available.

Qpoint is worth considering for endpoint-oriented discovery and monitoring, with its Community plan supporting up to 25 endpoints and built-in policy plugins.

Coroot fits teams wanting a self-hosted community edition plus paid tiers, including a Standard plan priced at $1 a month billed per monitored CPU core.

groundcover offers a freemium alternative with a free-forever plan, 12-hour data retention, Slack community support, and BYOC.

Kindling is a simpler free option with no premium tiers, subscriptions, or feature gates.

Odigos is preferable when your priority is OpenTelemetry tracing through an Apache 2.0 open-source edition.

Parca provides an Apache 2-licensed open-source option focused on continuous profiling.

For a broader comparison, see eBPF Observability Tools.

Verdict

Inspektor Gadget is a strong choice for engineering-led teams that need programmable eBPF inspection enriched with Kubernetes identity and can operate Linux-based, self-hosted infrastructure. Its main reason to choose it is the blend of packaged OCI gadgets, cluster context, and extensibility at no license cost. Look elsewhere if your environments include unsupported managed-container platforms or if maintaining only the latest release conflicts with your change-management policy.