Tracee
Tracee: Free, open-source eBPF monitoring for Linux, containers, and Kubernetes. Ranked #18 of 27 in Kubernetes Security Software by our editors (7.2/10); pricing: Free plan; best for teams needing free eBPF runtime monitoring.
At a glance
- Editor score7.2 / 10
- PricingFree plan
- Best forTeams needing free eBPF runtime monitoring
- Free planYes
- Paid fromFree
- Deployment modelSelf_hosted
- Founded2019 · Boston, United States and Ramat Gan, Israel
- Facts checked22 Sep 2026
Where it wins
- Real-time eBPF monitoring with built-in suspicious-behavior detections
- Kubernetes deployment through Helm and DaemonSets
- Artifact collection plus Prometheus and Grafana support
Where it doesn't
- Self-hosted Linux deployment requires infrastructure management
- Focused on runtime monitoring rather than verified scanning
- No verified posture management or admission features
Our verdict on Tracee
Tracee is an open-source runtime security and observability tool for Linux systems, applications, containers, and Kubernetes environments. It is designed for teams that need free, self-hosted eBPF monitoring, with real-time collection of system-call, process, file, network, and container events. Built-in detections identify suspicious behavior, while policy scopes, event rules, and filters help teams focus monitoring on selected workloads or event types.
Its strongest fit is a Kubernetes environment that already uses common container and monitoring components. Tracee can run locally as a binary or container, or across Kubernetes nodes through Helm and DaemonSets. It integrates with Docker, Containerd, CRI-O, and Podman for container contexts, and supports Prometheus metrics with Grafana dashboards. For investigations, network traffic, binary, memory, and file artifact collection extends the product beyond basic event visibility into runtime forensics.
Tracee’s scope is concentrated on runtime detection, observability, policy filtering, and forensic collection. That makes it a practical choice for teams prioritizing Linux and Kubernetes runtime signals without a paid plan. Organizations looking for verified image or registry scanning, posture management, admission control, or SBOM generation should choose a broader Kubernetes security product instead. Teams comfortable with self-hosted deployment and focused on detecting activity after workloads run should find its feature set more aligned with their needs.
Your product? Our editors can test Tracee in depth and publish a review, labelled as paid · from $149/mo →
Tracee pricing
Tracee fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Deployment model | Self_hosted |
| Image scanning | Not verified |
| Posture management | Not verified |
| Runtime protection | Yes |
| Admission control | Not verified |
| Identity security | Not verified |
| Managed Kubernetes | Not verified |
| Deployment | Self-hosted |
| Platforms | Linux |
| Support | Community, Docs |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Pricing | Free plan |
| Website | aquasecurity.github.io |
| Facts checked | 22 Sep 2026 |
Alternatives to Tracee
- Aqua SecurityBroad Kubernetes security spanning supply chain, posture, admission, runtime, and forensics.9.4
- Sysdig SecureA broad Kubernetes security platform for teams needing coverage from pipeline to runtime.9.3
- Trend Vision One Container SecurityBroad Kubernetes security coverage with usage-based pricing and a 30-day trial.9.1
Also Ranked In
Tracee is ranked in 4 of our directories.
Used Tracee? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Tracee for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Tracee is listed in our Kubernetes Security Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/tracee/"><img src="https://www.itechguides.com/best/badge/tracee.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update