Kerno

Paid LinuxSelf-hosted

What Kerno is

Kerno is a free, open-source incident diagnosis engine for production issues on Linux, including Kubernetes, virtual machines, and bare-metal hosts. Its eBPF-based `kerno doctor` command gathers 30 seconds of kernel data and returns ranked findings with causes, evidence, estimated resolution times, and suggested fixes. Eleven deterministic rules cover problems such as disk I/O bottlenecks, out-of-memory events, TCP retransmits, scheduler contention, and file descriptor leaks. Kerno traces syscall latency, disk I/O latency, and CPU scheduler delay, while watch commands monitor TCP connections and retransmits, OOM kills, and file descriptor leaks. It can run as a Kubernetes DaemonSet or as a binary on bare metal, VMs, EC2, and GCE; Linux Docker images are published for amd64 and arm64. Integrations include Prometheus metrics, ServiceMonitor support, Kubernetes pod enrichment, and systemd enrichment. Optional AI providers include Anthropic, OpenAI, and Ollama. Kerno makes no outbound network calls by default, and AI use is opt-in. Its eBPF programs are described as read-only observers that do not log file contents, environment variables, authentication tokens, or network payloads. Kubernetes requires Linux kernel 5.8 or later with BTF.

Who it suits

It suits Linux operations teams diagnosing production incidents across Kubernetes, cloud virtual machines, and bare-metal systems. Self-hosted deployments requiring kernel-level visibility and optional AI assistance may benefit from it.

What it does well

Free and licensed under Apache License 2.0
Ranked incident findings with evidence and suggested fixes
Deterministic rules for common kernel-level issues
Kubernetes DaemonSet and binary deployment options
No outbound network calls by default

What to know first

Requires Linux kernel 5.8 or later with BTF
Kubernetes deployment requires elevated capabilities
Standard NetworkPolicy generally does not restrict host networking

Verdict

Kerno concentrates on kernel-level diagnosis using eBPF and deterministic rules. Its self-hosted deployment options, monitoring commands, and opt-in integrations make it suited to teams investigating Linux production incidents.

Facts from Kerno's own pages

Deployment: Kerno can run as a Kubernetes DaemonSet or as a binary on bare metal, VMs, EC2, and GCE; Docker images are published for Linux amd64 and arm64. · github.com, 8 Oct 2026
Diagnosis rules: The engine evaluates 11 deterministic rules covering issues such as disk I/O bottlenecks, OOM events, TCP retransmits, scheduler contention, and file descriptor leaks. · github.com, 8 Oct 2026
Incident reports: The `kerno doctor` command collects 30 seconds of kernel data and returns ranked findings with causes, evidence, ETAs, and suggested fixes. · github.com, 8 Oct 2026
Integrations: The project lists Prometheus metrics and ServiceMonitor support, Kubernetes pod enrichment, optional Anthropic, OpenAI, and Ollama providers, and systemd enrichment. · github.com, 8 Oct 2026
Kernel requirement: The quick start requires Linux kernel 5.8 or later with BTF; Helm or raw manifest deployment requires cluster-admin. · github.com, 8 Oct 2026
License: The repository identifies Kerno as licensed under Apache License 2.0. · github.com, 8 Oct 2026
Monitoring: Its watch commands cover TCP connections and retransmits, OOM kills, and file descriptor leak detection. · github.com, 8 Oct 2026
Network policy limitation: The README cautions that standard Kubernetes NetworkPolicy resources generally do not restrict Kerno because it uses host networking, unless host-firewall configuration is used. · github.com, 8 Oct 2026
Permissions: The documented Kubernetes security posture lists CAP_BPF, CAP_PERFMON, CAP_SYS_PTRACE, CAP_NET_ADMIN, and CAP_DAC_READ_SEARCH, and says the hot path does not require CAP_SYS_ADMIN. · github.com, 8 Oct 2026
Privilege requirement: Kerno needs elevated privileges or documented Linux capabilities to load eBPF programs into the kernel. · github.com, 8 Oct 2026
Purpose: Kerno is an eBPF-based incident diagnosis engine for production issues across Linux, Kubernetes, VMs, and bare metal. · github.com, 8 Oct 2026
Requirements: Kubernetes use requires Linux kernel 5.8 or later with BTF, and raw manifests or Helm installation require cluster-admin access. · github.com, 8 Oct 2026
Roadmap limits: The roadmap lists OpenTelemetry export and Grafana dashboards for v0.2, Slack and PagerDuty integrations for v0.3, and a managed Optiqor Cloud offering for v1.0. · github.com, 8 Oct 2026
Security: The project says Kerno makes no outbound network calls by default and that AI integration is opt-in through the configured provider. · github.com, 8 Oct 2026
Security details: The security policy says Kerno's eBPF programs are read-only observers and that it does not log file contents, environment variables, authentication tokens, or network payloads. · github.com, 8 Oct 2026
Security posture: The README says Kerno makes no outbound network calls by default and that AI integration is opt-in through a configured provider. · github.com, 8 Oct 2026
Support: The security policy directs general questions to GitHub Discussions and vulnerability reports to [email protected], with acknowledgment targeted within 48 hours. · github.com, 8 Oct 2026
Tracing: Kerno supports syscall latency, disk I/O latency, and CPU scheduler delay tracing. · github.com, 8 Oct 2026

Where Kerno stands on Freedom251

eBPF Observability Tools#26 of 29