Tracee

Tracee is a free, open-source runtime security and observability sensor for Linux hosts and Kubernetes environments. It is best suited to security engineers and platform teams that can operate self-hosted infrastructure and grant kernel-level capabilities. Its main advantage is detailed, real-time kernel context; its main trade-offs are Linux-only coverage, kernel compatibility checks, and privileged deployment.

Overview

Tracee uses eBPF to observe Linux system calls, network activity, and file operations as they occur. It emits real-time events and identifies behavior patterns that may indicate security threats. Events include process lineage, file paths, and network connections, so an alert can be investigated in relation to the activity around it rather than as an isolated syscall.

Monitoring requires no application code changes and is designed for low overhead. Container awareness helps operators associate host events with container workloads, while flexible policies allow teams to tune collection for security monitoring, compliance, troubleshooting, or forensic investigation. Tracee is a sensor you operate yourself, so deployment, policy management, event handling, and response remain your responsibility.

Key features

Runtime detection and context

Suspicious-behavior detection and immediate event generation give incident responders a useful starting point. Process, file, and network relationships can clarify what happened and which workload was involved. LSM-based events can be cross-referenced with syscall events to reduce the race condition involved in reading user-program information, adding defensive context for investigations.

Deployment and observability

You can run Tracee as an executable binary, a Docker Hub image, or a Helm chart in Aqua Security’s registry. The Helm route is documented for Kubernetes, making it a practical fit for teams already managing clusters. Prometheus scraping is enabled by default, with metrics exposed at :3366/metrics, so existing monitoring systems can collect operational data without a separate integration layer.

Pricing

Tracee — free. The open-source project has no paid plan and no free trial because the software is free to run. This suits teams that want to deploy their own runtime sensor without license fees. The price does not remove the operational costs of compatible Linux hosts, Kubernetes administration, policy tuning, event storage, or incident response. The project is Linux-only and requires a compatible kernel plus elevated capabilities.

Platforms

Tracee supports Linux in self-hosted deployments and runs on x86 and arm64 processors. Documented long-term-supported kernel versions include 5.4, 5.10, 5.15, 6.2, and 6.5; some distribution kernels may also work. It needs substantial capabilities to instrument the kernel, with privileged or root execution described as the easiest setup. It does not run directly on macOS. A Linux virtual machine can run it, but Tracee then observes the VM rather than the Mac host.

Who it's for

Choose Tracee if your security or platform team controls Linux hosts or Kubernetes clusters and wants runtime visibility without modifying applications. It is particularly well matched to investigations that benefit from process, file, and network relationships, and to organizations that already operate Prometheus. It is a poor fit for heterogeneous endpoint fleets, teams unable to grant elevated privileges, or buyers seeking a managed service with provider-operated deployment and response.

Pros and cons

• Pro: Real-time eBPF monitoring covers syscalls, network activity, and file operations without application code changes.
• Pro: Process lineage, paths, and connections provide investigation context, while container awareness helps map activity to workloads.
• Pro: Binary, container-image, and Helm deployments accommodate standalone hosts and Kubernetes.
• Con: Linux-only operation excludes Windows and direct macOS host monitoring.
• Con: Kernel-version compatibility and privileged or root execution add deployment and security-governance work.
• Con: Self-hosting leaves storage, tuning, and response operations to your team.

Alternatives

For broader Kubernetes policy and cluster coverage, consider Calico Cloud; its free tier supports one user and one cluster, retains logs for 24 hours, and requires Calico 3.30 or later. Amazon GuardDuty is a managed, pay-as-you-go option with a 30-day trial, suited to teams that prefer AWS-operated detection over self-hosting.

Falco, KubeArmor, and Tetragon are free open-source alternatives for Linux and Kubernetes-oriented runtime security. Choose Qualys TotalCloud when a cloud platform with a limited free license and paid subscription path is preferable. Sysdig Secure fits organizations wanting a commercial platform licensed by host count. Bitdefender Total Security targets individual multi-device protection rather than Linux runtime instrumentation.

For category comparisons, see Cloud Workload Protection Platforms, Kubernetes Security Software, Container Security Software, and eBPF Observability Tools.

Verdict

Tracee is a strong choice for technically capable teams that need free, self-hosted Linux runtime monitoring with rich event context and Kubernetes deployment options. Choose it for kernel-level visibility and flexible collection without changing application code. Look elsewhere if you need other operating systems, a managed operating model, or deployment that avoids elevated kernel capabilities.