Inspektor Gadget: eBPF Observability for Kubernetes and Linux
Shriira Press
Turn the raw firehose of kernel events into something a Kubernetes operator can actually read — one eBPF gadget at a time.
Welcome to Inspektor Gadget: eBPF Observability for Kubernetes and Linux.
Inspektor Gadget is a CNCF sandbox project that makes eBPF approachable for the people who run clusters rather than write kernel code. The kernel sees everything — every file opened, every process spawned, every packet sent — but it sees those events in terms of mount namespaces and process IDs, not pods and containers. Inspektor Gadget closes that gap. It packages eBPF programs as portable OCI images called gadgets, loads them on demand, and automatically enriches the events they emit with the Kubernetes and container context an operator needs. This book starts with the problem eBPF solves and why low-level data is so hard to use, then builds up the project's mental model: what a gadget is, how image-based gadgets are distributed like container images, how the operator pipeline turns raw kernel events into readable output, and how a DaemonSet maps namespaces back to pods. From there it moves into daily use with kubectl gadget and ig, exporting metrics to observability backends, writing your own gadgets, and the practices that make all of this safe in production.
This title is part of the ShriIra library and is free to read in full, right here — our small contribution to making world-class knowledge easy to reach.
A note on reading it: open the Contents menu at the top of the reader to jump between chapters, use the Aa menu to set a comfortable text size, theme (light, sepia, or night), and single- or two-page layout. Your place is saved automatically, so you can always pick up where you left off.
We hope it serves you well.
— Shriira Press