eBPF Tetragon Runtime Security Guide 2026

Q: What is Tetragon and how does it differ from traditional Linux security tools?

Tetragon is an open-source runtime security enforcement tool built on eBPF that observes and blocks malicious behavior at the kernel level. Unlike auditd or AppArmor, it provides real-time visibility into syscalls, file access, and network activity with minimal overhead, enabling precise policy enforcement without modifying application code or relying solely on static signatures.

Q: Does Tetragon require a specific Linux kernel version to run?

Yes, Tetragon requires Linux kernel 5.15 or higher for full eBPF tracing support. Kernel 6.x is recommended for advanced features like kprobe multi-attach and improved performance. On older kernels, functionality degrades significantly. Ubuntu 22.04 LTS and Debian 12 ship compatible kernels by default, making them safe choices for production deployments in Nepal or elsewhere.

Q: How much does Tetragon cost for commercial use?

Tetragon is Apache 2.0 licensed and free for any use, including commercial production systems. Cilium Enterprise offers paid support and managed policies starting around USD 500/month (NPR 67,000), but the core engine remains fully open source with no feature gating.

Q: Can Tetragon block processes or only monitor them?

Tetragon can both monitor and enforce. Using TracingPolicy with action: SIGKILL or action: ENOENT, it terminates or denies system calls matching defined rules. Enforcement happens in-kernel via eBPF LSM hooks, so blocked actions never reach userspace. This makes it suitable for preventing credential theft, reverse shells, or unauthorized file writes in real time.

Q: How do I install Tetragon on Ubuntu 24.04 server?

Install via the official APT repository: add the Cilium GPG key, add the repo, then run apt install tetragon. Enable and start the service with systemctl enable --now tetragon. Verify with tetra status. For production, pin the package version and test policies in dry-run mode first. Avoid installing from source unless you need custom eBPF program modifications.

Q: What are common performance gotchas when deploying Tetragon in production?

Overly broad tracing policies cause high CPU usage due to excessive event generation. Always scope policies to specific binaries, namespaces, or cgroups. Avoid tracing high-frequency syscalls like read/write globally. Use sampling or rate limiting in non-critical environments. In my experience running eBPF tools on shared EC2 instances, unscoped policies have caused 30%+ CPU spikes during peak traffic. Monitor /sys/kernel/debug/tracing/trace_pipe for backpressure signals.

Q: How does Tetragon compare to Falco for runtime security?

Falco uses kernel modules or eBPF probes primarily for detection and alerting, while Tetragon emphasizes in-kernel enforcement with lower latency. Tetragon’s policy language is declarative YAML tied directly to eBPF programs, whereas Falco relies on Lua rules evaluated in userspace. For blocking attacks in real time, Tetragon is superior. For compliance logging and forensic analysis across diverse environments, Falco has broader ecosystem integrations. Many teams now run both: Tetragon for prevention, Falco for audit trails.

Q: Can Tetragon integrate with existing SIEM or log aggregation systems?

Yes, Tetragon exports structured JSON events via stdout, gRPC, or Prometheus metrics. Configure output to Fluent Bit, Vector, or OpenTelemetry Collector for forwarding to Elasticsearch, Loki, or Datadog. Events include process lineage, syscall args, and container metadata. On legal-tech portals I’ve secured, we pipe Tetragon logs to a centralized Loki stack alongside Laravel application logs for unified incident investigation. Ensure log volume is manageable by filtering at the policy level before export.

Q: How do I write a Tetragon policy to prevent SSH brute force attacks?

Create a TracingPolicy targeting sshd binary, monitoring connect and accept syscalls. Add a matcher for failed authentication patterns using return value checks. Combine with rate-limiting logic or pair with fail2ban for IP blocking. Pure eBPF cannot track state across connections easily, so use Tetragon for signal generation and external tools for response. Test thoroughly in monitor mode first; false positives can lock out legitimate admins during maintenance windows.

Q: Is Tetragon safe to run on production web servers hosting Laravel applications?

Yes, when configured correctly. Tetragon adds negligible overhead (

Kokil Thapa
August 21, 2026
11 min read

By Kokil Thapa | Last reviewed: September 2026

Web application firewalls and dependency scanners catch many attacks, but they miss shell escapes that run inside a compromised PHP-FPM worker. eBPF Tetragon closes that gap by enforcing security policies at the Linux kernel without patching your Laravel, WordPress, or API code. If you already follow server security best practices for Nepal-hosted sites, Tetragon adds the runtime layer those controls cannot reach. This guide covers the Tetragon agent, getting started steps, TracingPolicy examples, and how Tetragon security compares to Falco and auditd on production Ubuntu servers.

Quick answer: eBPF Tetragon is Cilium's open-source runtime security engine that attaches sandboxed kernel programs to syscalls and LSM hooks. The Tetragon agent enriches events with process context, then logs or blocks actions like unauthorized shell execution with low overhead on Linux 5.15+.

What Is eBPF Tetragon and How Does the Tetragon Agent Work?

Tetragon is not a post-incident log miner. It is a kernel-level enforcement engine built on extended Berkeley Packet Filter (eBPF) programs that Cilium maintains alongside its networking stack. The Tetragon agent runs in user space on each node. It loads TracingPolicies, attaches eBPF probes to kernel functions, and decides whether to log, override, or kill a process.

On production Linux hosts I manage for legal-tech portals and eCommerce APIs, the dangerous gap sits between "app passes a security review" and "attacker executes /bin/sh from php-fpm." Traditional auditd adds heavy I/O. strace is a debugging tool, not a guard. eBPF programs compile to a verified bytecode sandbox inside the kernel. They cannot crash the host if written correctly, which is why Tetragon security workloads typically stay under 3% CPU on modern kernels.

The pipeline has three stages. Kernel probes capture raw syscall data through kprobes, tracepoints, or LSM hooks. The Tetragon agent correlates each event with binary path, arguments, cgroup, and full process ancestry. Output flows to JSON logs, OpenTelemetry, or immediate enforcement via Sigkill or syscall override.

eBPF Tetragon flows from verified kernel probes through the Tetragon agent to logging or real-time enforcement without application changes.

That separation matters for latency-sensitive stacks. Complex policy logic stays in user space. The kernel hot path only runs lightweight eBPF bytecode. Under load on a busy WooCommerce or API server, this design keeps response times stable while still blocking exploit chains.

How Do You Get Started with Tetragon on Ubuntu or Kubernetes?

Tetragon getting started paths split by environment. Bare-metal or VPS hosts running Laravel on Ubuntu with Nginx suit a systemd install. Kubernetes clusters need a DaemonSet so every node runs the Tetragon agent. Both require a recent kernel with BTF support for full feature coverage.

Bare-metal and VPS install (Ubuntu 22.04 / 24.04)

Use the official Cilium APT repository. Pin versions in staging before production rollout. The commands below match the current stable channel documented in the Tetragon GitHub repository.

curl -fsSL https://deb.cilium.io/gpg.key | sudo gpg --dearmor -o /usr/share/keyrings/cilium-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/cilium-archive-keyring.gpg] https://deb.cilium.io stable main" | sudo tee /etc/apt/sources.list.d/cilium.list

sudo apt update
sudo apt install tetragon

sudo systemctl enable --now tetragon
sudo systemctl status tetragon
tetragon status

Run uname -r and confirm Linux 5.15 or newer. Check BTF with ls /sys/kernel/btf/vmlinux. Missing BTF forces fallback mode with reduced LSM support. Upgrade the kernel package or install a BTF-enabled image before relying on enforcement policies.

Kubernetes install via Helm

For microservices or multi-tenant Laravel SaaS on Kubernetes, install Tetragon as a cluster-wide DaemonSet.

helm repo add cilium https://helm.cilium.io/
helm repo update

helm install tetragon cilium/tetragon \
  --namespace kube-system \
  --set tetragon.enabled=true \
  --set export.stdout.enabled=false \
  --set export.aggregator.enabled=true

Disable stdout export in production. High-traffic clusters flood pod logs and waste disk I/O. Ship events to OpenTelemetry or a log aggregator instead. Pair Tetragon with Kubernetes network policies for defense in depth at the network and syscall layers.

First validation steps after install

Confirm the Tetragon agent reports healthy probes via tetragon status.
Apply a log-only TracingPolicy scoped to one binary path.
Trigger a harmless test event and verify JSON output shape.
Enable enforcement only after baseline noise review.
Document kernel version and policy set in your runbook.

What Tetragon Use Cases Matter for Web Application Servers?

Tetragon use cases for PHP, Node, and container workloads cluster around behaviors WAFs never see. These patterns map directly to stacks I harden through Linux system administration services for clients in Nepal and abroad.

Block shell execution from web workers

Remote code execution in a plugin or dependency often ends with execve on /bin/sh. A TracingPolicy can return EPERM when php-fpm tries to spawn a shell while still allowing legitimate deploy scripts run as a separate user.

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: prevent-php-shell-execution
spec:
  kprobes:
    - call: "sys_execve"
      syscall: true
      selectors:
        - matchBinaries:
            - path: "/usr/sbin/php-fpm"
              operator: Prefix
          matchActions:
            - action: Log
              kernelReturn: false
            - action: Override
              overrideAction:
                returnCode: -1
              kernelReturn: true
  options:
    - name: "policy-name"
      value: "prevent-php-shell-execution"

Set kernelReturn: true on override actions. Without it, Tetragon logs the attempt but the shell still runs. Test from a staging worker before enabling on production.

Audit sensitive document directories

Legal-tech portals on platforms like Mijar Law Associates store client files outside the public web root. Tetragon captures who opened which path, with full parent process chain. auditd logs PID alone and misses container context.

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: monitor-sensitive-documents
spec:
  kprobes:
    - call: "sys_openat"
      syscall: true
      selectors:
        - matchPaths:
            - path: "/var/www/legal-portal/storage/documents/"
              operator: Prefix
          matchActions:
            - action: Log
              kernelReturn: false
  lsm:
    - hook: "file_open"
      selectors:
        - matchPaths:
            - path: "/etc/shadow"
              operator: Equal
          matchActions:
            - action: Sigkill
              kernelReturn: false

LSM hooks need CONFIG_BPF_LSM and kernel 5.7+. Start LSM rules in log-only mode. A bad file_open policy can block SSH login.

Detect crypto miners and reverse shells

Watch for unexpected connect syscalls from www-data to external IPs on ports 4444 or 3333. Combine with matchBinaries on nginx or php-fpm. Export alerts to the same stack you use for Prometheus and Grafana monitoring.

Protect deployment pipelines

Allow execve from your deploy user and CI runner UID. Deny it from the web tier. This pattern fits Deployer-based releases described in zero-downtime Laravel deployment workflows where php-fpm must never spawn shells.

Each eBPF Tetragon TracingPolicy evaluates selectors on every matching syscall before logging or blocking at the kernel.

How Does eBPF Tetragon Compare to Falco, Auditd, and Seccomp?

Runtime tooling overlap confuses many teams. Tetragon is not a universal replacement. It excels where you need both context and enforcement. The table below reflects production usage on Ubuntu 22.04/24.04 PHP stacks in 2026. For Kubernetes-only detection without blocking, see Falco runtime security for Kubernetes.

Feature	Tetragon	Falco	auditd	Seccomp
Technology	eBPF kprobes + LSM	eBPF / kernel module	Kernel audit subsystem	BPF filter / prctl
Enforcement	Block + log	Detect only	Log only	Block only
Overhead	Low (<3%)	Medium (5–10%)	High (10–20%+)	Negligible
Process context	Full ancestry + cgroup	Full ancestry + cgroup	PID-focused	None
Policy shape	Path, binary, args, net	Syscall + fields	Syscall + path + UID	Syscall numbers
Kubernetes native	Yes (CRDs)	Yes (Helm)	Host-level only	Pod annotations
Best for	Prevention + visibility	SOC alerting	Compliance audit trail	Immutable containers

Choose Tetragon when you must stop exploits in real time and your kernel supports BTF plus LSM BPF. Choose Falco when detection and SIEM integration matter more than blocking. Keep auditd where PCI-DSS or HIPAA mandates audit subsystem logs. Use seccomp for hardened containers with a fixed syscall surface, as covered in seccomp syscall restriction guides.

What Production Pitfalls Break Tetragon Security Deployments?

These failures appear on live systems, not in lab READMEs. Avoid them before you enable Sigkill on production php-fpm pools.

Missing BTF: Run ls /sys/kernel/btf/vmlinux. Without BTF, advanced probes fail or fall back silently. Align with CIS benchmark hardening that recommends current kernel packages.
Over-broad selectors: A prefix match on / logs every openat system-wide. Scope to one binary or directory. Use tetragon policy trace in staging first.
stdout export in prod: Helm charts often enable stdout for demos. Turn it off and pipe to OpenTelemetry instrumentation or a rotated file sink.
cgroup v1 hosts: Run stat -fc %T /sys/fs/cgroup/. Container metadata enrichment needs cgroup v2. Upgrade before relying on pod labels in events.
Policy race on update: Policy swaps are eventually consistent. Version policies in Git and update in place. Never delete and recreate a blocking rule during traffic peaks.
Multi-tenant bleed: Cluster-wide policies can block tenant B when you target tenant A. Use matchNamespaces on shared Kubernetes clusters.

Six-step eBPF Tetragon checklist: verify kernel prerequisites, test policies safely, then automate enforcement in CI.

Log volume grows fast on busy hosts. Parse sample events with a JSON formatter during policy tuning so field names stay consistent before you wire SIEM parsers. Store policies in Git beside your infrastructure code, the same way you manage Ubuntu server security baselines.

eBPF Tetragon sits between application controls and host hardening, catching runtime exploits that never touch your WAF rules.

eBPF development skills are scarce globally. Teams searching for specialized kernel engineers often underestimate policy maintenance cost. Most web teams get better ROI by pairing managed WAF rules with a focused Tetragon policy set rather than hiring dedicated eBPF staff. For ongoing hardening on Nepal VPS or EC2 fleets, support and maintenance services cover kernel upgrades and policy reviews alongside application patches.

Align Tetragon rollout with broader trends in cybersecurity for developers in 2026. Runtime enforcement complements dependency scanning and Ubuntu web server hardening. It does not replace either layer.

Key Takeaways

Install the Tetragon agent on Linux 5.15+ with BTF before enabling LSM enforcement policies.
Start every TracingPolicy in log-only mode with narrow selectors on one binary or directory.
Block php-fpm shell execution with execve override and kernelReturn: true.
Export events to OpenTelemetry or rotated files — never stdout on production clusters.
Combine eBPF Tetragon with WAF, seccomp, and patch management for full defense in depth.
Store TracingPolicies in Git and validate YAML in CI before cluster-wide apply.

Deploy eBPF Tetragon Where Your Stack Needs It

eBPF Tetragon shifts runtime security from passive logging to active kernel enforcement. For Laravel APIs, WooCommerce stores, and legal-tech portals on Linux, that means blocking shell escapes and auditing sensitive paths without redeploying PHP code. Start with one log-only policy, prove value on staging, then enable blocking on your highest-risk binaries.

Tetragon complements — not replaces — WAFs, vulnerability scans, and compliance auditors. It targets the attack stage those tools miss after initial compromise. If you want help mapping TracingPolicies to your deploy pipeline and threat model, contact us about runtime security hardening. You can also discuss your current server architecture before enabling enforcement on production traffic.

Frequently Asked Questions