Deploy as a container

Install

Stable versions

To run a stable version, please check Tetragon quay repository and select which version you want. For example if you want to run the latest version which is v1.3.0 currently.

docker run --name tetragon --rm -d                   \
    --pid=host --cgroupns=host --privileged          \
    -v /sys/kernel/btf/vmlinux:/var/lib/tetragon/btf \
    quay.io/cilium/tetragon:v1.3.0

Unstable-development versions

To run unstable development versions of Tetragon, use the latest tag from Tetragon-CI quay repository. This will run the image that was built from the latest commit available on the Tetragon main branch.

docker run --name tetragon --rm -d                  \
   --pid=host --cgroupns=host --privileged          \
   -v /sys/kernel/btf/vmlinux:/var/lib/tetragon/btf \
   quay.io/cilium/tetragon-ci:latest

Configuration

There are multiple ways to set configuration options:

1. Append Tetragon controlling settings at the end of the command

   As an example set the file where to export JSON events with --export-filename argument:

   docker run --name tetragon --rm -d \
       --pid=host --cgroupns=host --privileged \
       -v /sys/kernel:/sys/kernel \
       quay.io/cilium/tetragon:v1.3.0 \
       /usr/bin/tetragon --export-filename /var/log/tetragon/tetragon.log
   

   For a complete list of CLI arguments, please check Tetragon daemon configuration.

2. Environment variables

   docker run --name tetragon --rm -d \
       --pid=host --cgroupns=host --privileged \
       --env "TETRAGON_EXPORT_FILENAME=/var/log/tetragon/tetragon.log" \
       -v /sys/kernel:/sys/kernel \
       quay.io/cilium/tetragon:v1.3.0
   

   Every controlling setting can be set using environment variables. Prefix it with the key word TETRAGON_ then upper case the controlling setting. As an example to set where to export JSON events: --export-filename will be TETRAGON_EXPORT_FILENAME.

   For a complete list of all controlling settings, please check tetragon daemon configuration.

3. Configuration files mounted as volumes

   On the host machine set the configuration drop-ins inside /etc/tetragon/tetragon.conf.d/ directory according to the configuration examples, then mount it as volume:

   docker run --name tetragon --rm -d \
       --pid=host --cgroupns=host --privileged \
       -v /sys/kernel:/sys/kernel \
       -v /etc/tetragon/tetragon.conf.d/:/etc/tetragon/tetragon.conf.d/ \
       quay.io/cilium/tetragon:v1.3.0
   

   This will map the /etc/tetragon/tetragon.conf.d/ drop-in directory from the host into the container.

See Tetragon daemon configuration reference for further details.