Tetragon is Cilium’s eBPF-based runtime security component for observing and enforcing behavior on Linux systems, including Kubernetes workloads. It applies filters and enforcement in the kernel, then sends selected events to its user-space agent. TracingPolicy objects connect the events to inspect, the conditions to match, and the response to take.
What Tetragon does
Tetragon provides security observability and runtime enforcement for activity such as process execution, system calls, file access, and network I/O. In Kubernetes, it can associate processes and events with workload context such as namespaces and pods, helping an operator relate host-level behavior to the workloads that produced it.
It is not simply a log collector. Its policies can inspect activity as it occurs and, where configured, take action in the kernel inline with the operation. That makes it useful for both investigating what a workload did and constraining selected behavior while it is happening.
How Tetragon uses eBPF
Policy hooks and context
Tetragon policies describe kernel functions to observe, the arguments or return values to inspect, and the conditions that make an event relevant. A policy can combine kernel-level details with information about a process, file, socket, namespace, capabilities, and Kubernetes identity. Tetragon applies the corresponding instrumentation through eBPF.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Filtering before events reach user space
For frequent activity such as send, read, and write operations, passing every event to a user-space process can create unnecessary context switches and wake-ups. Tetragon can apply filters in the kernel—such as conditions based on file, socket, binary name, namespace, or capabilities—and send selected events to its agent. This design reduces unnecessary event handling; it does not establish a universal CPU or memory saving. The official documentation does not provide an authoritative benchmark for Tetragon’s overhead, detection accuracy, or false-positive rate.
The practical meaning of “extending eBPF” is that policy authors specify what to observe or enforce, while Tetragon handles applying the relevant kernel instrumentation and connecting the results to workload context and actions.
How Tetragon works with Cilium
Cilium provides network identity and policy context for Kubernetes workloads. Tetragon adds visibility into process and host-runtime activity, with enforcement options for selected runtime events. Together, they cover different parts of workload security: Cilium network policy governs network communication, while Tetragon policies address behavior such as executing a process or accessing a file.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
That division matters when investigating a compromise. Network policy can restrict where a workload communicates, but it does not by itself explain or stop every action inside a container. Runtime monitoring can expose or constrain those actions, but it does not replace network controls. Cilium’s threat model recommends runtime-security tools such as Tetragon to detect container compromises as they occur.
What a TracingPolicy describes
A TracingPolicy is the bridge between an event of interest and the response to it. In practical terms, policy authors choose a runtime hook, specify the relevant conditions and context, and configure whether matching activity should be observed or enforced. Tetragon’s policy concepts also include event throttling, and its policy library pairs structured examples with their use cases.
- Hook: the kernel function or runtime point where Tetragon observes activity.
- Selectors: the conditions that narrow matching activity, using available process, file, socket, namespace, capability, or Kubernetes context.
- Action: whether to report the event, enforce a response, or combine applicable actions.
- Event handling: filters and throttling help control which events are emitted and how frequently.
Because hook names, policy fields, and supported actions can vary by Tetragon release, use the policy examples and documentation matching the version you deploy rather than copying a policy written for another release.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Can Tetragon block malicious behavior?
Yes, for supported events and correctly configured policies. Tetragon documents two kernel enforcement mechanisms: overriding a function’s return value, or sending a signal such as SIGKILL to a process. These actions are not equivalent.
| Mechanism | What it does | Important qualification |
|---|---|---|
| Return-value override | Changes a function’s return value; depending on the hook and policy, this can prevent a system call or security-check function from completing normally. | It acts on the operation at the hook, so the chosen hook and override behavior must match the intended protection. |
| Signal, such as SIGKILL | Sends a signal to the process associated with the event. | A signal does not necessarily undo or prevent the operation that triggered it. The documentation gives a write as an example: SIGKILL during a write does not guarantee that the data was not written. |
If the security goal is to prevent the operation itself, rather than terminate the process after a matching event, the policy may need to combine a return-value override with a signal. The right action depends on what the hook can intercept and what outcome the policy is intended to guarantee.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Limitations and production considerations
It cannot secure a host against its most privileged attacker
A root-equivalent attacker on the host may be able to disable eBPF, removing Cilium’s network and runtime visibility and enforcement. Tetragon is therefore not a substitute for securing the host and limiting privileged access.
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
Policy correctness and upgrades matter
A policy only protects the behavior its hooks and selectors match, and enforcement can have consequences if conditions are too broad. Review policies against their use cases, test their effects in a controlled environment, and verify that they remain compatible when upgrading.
As of October 3, 2026, the official Tetragon releases page lists v1.7.1, released August 25, 2026. Its upgrade notes say TracingPolicy returnArgAction no longer accepts Post; policies using that value should remove the field and use the supported behavior described in the release note. Check the release notes and policy compatibility for the exact version you intend to deploy.
Runtime controls belong in a broader security plan
Cilium’s threat model also points to foundational safeguards: least privilege, patched and minimal images, resource limits, centralized Kubernetes audit logging, and careful review of privileged workloads. These measures reduce exposure and preserve useful evidence even when a runtime control cannot address the underlying weakness.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
