Inspektor Gadget uses eBPF to obtain the insights it provides. The different gadgets provided use different eBPF capabilities. The capabilities available depend on the version of the kernel running in the node, as well as whether or not the kernel has BTF enabled (via CONFIG_DEBUG_INFO_BTF=y).

    The required BTF information for some well known kernel versions is generated with BTFGen and shipped within the gadget container image. If there are not shipped types for the running kernel then they are downloaded from BTFhub .

    Required Kernel Versions

    This section summarizes the kernel versions and features that are required to run the gadgets. This has been generated by testing different Ubuntu versions and their shipped kernels, hence it’s possible that some gadgets work in older kernels than the one mentioned here.

    Gadget Tools Mode Required Kernel BTF Required
    bindsnoop standard 4.15 N
    bindsnoop core 5.4 1 Y
    biolatency standard 4.15 N
    capabilities 4.15 N
    dns 5.4 N
    execsnoop standard 4.15 N
    execsnoop core 5.4 1 Y
    network policy advisor
    opensnoop standard 4.15 N
    opensnoop core 5.4 1 Y
    socket collector 5.10 Y
    process collector 5.10 Y
    tcpconnect standard 4.15 N
    tcpconnect core 5.8 Y
    tcptop standard 4.15 N
    tcptracer standard 4.15 N
    traceloop 4.15 N

    1: By using btfhub