cilium/tetragon

View on GitHub

eBPF-based Security Observability and Runtime Enforcement

Stars: 5k
Forks: 610
Open beginner issues: 0
Indexed issues: 133
Avg merge: 1d 23h
Merged PRs (30d): 152

Dominant language: C
License: Apache-2.0
Last GitHub push: Sep 19, 2026
Latest indexed: Sep 20, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue

Beginner friendly Everything

Open All

133 open issues indexed

bug : Field-filter failure delivers unredacted events instead of failing closed Open

Difficulty 4/5 3-5 days Newbie friendliness 56/100

cilium/tetragon#5685 · Opened Sep 19, 2026
feature: allow matchUserCaller to match on the immediate caller on arm64 Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

cilium/tetragon#5662 · Opened Sep 17, 2026
bug : logger.Fatal exits 255 and skips deferred cleanup (pidfile, metrics, sensor unload) Open

Difficulty 2/5 1-3 hours Newbie friendliness 85/100

cilium/tetragon#5659 · 1 comment · Opened Sep 17, 2026
bug : daemon panic on empty/all-NUL matchArgs values in NUL-strip selectors Open

Difficulty 3/5 1-2 days Newbie friendliness 84/100

cilium/tetragon#5650 · 2 comments · Opened Sep 16, 2026
Summary Section in vmtests Open

Difficulty 3/5 1-2 days Newbie friendliness 48/100

cilium/tetragon#5644 · 1 comment · Opened Sep 15, 2026
health: add dedicated HEALTH_STATUS_INITIALIZING state Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

cilium/tetragon#5639 · Opened Sep 14, 2026
Enforce string postfix max length Open

Difficulty 3/5 1-2 days Newbie friendliness 55/100

cilium/tetragon#5616 · Opened Sep 11, 2026
bug : observer panics (OOM) on truncated MSG_OP_DATA record: unchecked size arithmetic in add() Open

Difficulty 3/5 1-2 days Newbie friendliness 78/100

cilium/tetragon#5614 · 3 comments · Opened Sep 10, 2026
Wrap bytes.Reader() in the event delivery hotpath Open

cilium/tetragon#5612 · 1 assignee · Opened Sep 10, 2026
proto: store proc args in a repeated string Open

cilium/tetragon#5611 · 1 assignee · Opened Sep 10, 2026
Kprobe spec validation failures Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

cilium/tetragon#5598 · Opened Sep 9, 2026
consolidate per-sensor selector and action validation Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

cilium/tetragon#5590 · Opened Sep 8, 2026
bprm_check_security with Override: one refused execve emits hundreds of PROCESS_LSM events (v1.7.1, single lsmhooks entry) Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

cilium/tetragon#5528 · 1 comment · Opened Aug 31, 2026
Support lockdown=confidentiality (SecureBoot): use bpf_probe_read_kernel so bpf_exit_*.o can load Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

cilium/tetragon#5507 · 2 reactions · Opened Aug 26, 2026
Unbounded enumeration in writeRangeInMap causes CPU-pegging hang during policy parsing Open

Difficulty 4/5 3-5 days Newbie friendliness 68/100

cilium/tetragon#5502 · Opened Aug 25, 2026
docs: fileless execution policy does not cover shared memory (/dev/shm) Open

Difficulty 2/5 Half a day Newbie friendliness 76/100

cilium/tetragon#5480 · Opened Aug 22, 2026
Make CI run policytests against tetragon with process cache disabled Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

cilium/tetragon#5458 · Opened Aug 18, 2026
Make best effort to enrich events with process info when the process cache is disabled Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

cilium/tetragon#5457 · 1 comment · Opened Aug 18, 2026
Add a flag that allows disabling the process cache Open

cilium/tetragon#5420 · 1 assignee · Opened Aug 12, 2026
lsmhooks do not support matchData despite being documented in the TracingPolicy API reference Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

cilium/tetragon#5373 · 2 comments · 1 reaction · Opened Aug 3, 2026
bpf: USDT big-endian arg handling references a nonexistent variable Open

area/bpf kind/bug

cilium/tetragon#5302 · 2 comments · 1 assignee · Opened Jul 18, 2026
Support policytests operator `addrOf` and `offsetOf` for policy template Open

cilium/tetragon#5284 · 1 reaction · 1 assignee · Opened Jul 16, 2026
BPF-LSM: generic_lsm_output re-emits a stale per-CPU event on every unrelated syscall, producing phantom events for pods that did nothing Open

Difficulty 4/5 3-5 days Newbie friendliness 56/100

cilium/tetragon#5237 · 4 comments · Opened Jul 4, 2026
ci: prevent external contributors to run anything from the CI Open

area/ci

Difficulty 4/5 3-5 days Newbie friendliness 45/100

cilium/tetragon#5228 · 4 comments · 2 reactions · Opened Jul 3, 2026
Documentation: broken links automatic report Open

automated-issue

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

cilium/tetragon#5225 · Opened Jul 3, 2026
Feature: Dynamically watch and reload tracing policies via filesystem watcher (gated by flag) Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

cilium/tetragon#5215 · 1 comment · Opened Jul 2, 2026
Expose uprobe digest information via the tetra command Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

cilium/tetragon#5180 · Opened Jun 23, 2026
community: create a space for sharing tetragon policies Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

cilium/tetragon#5172 · 10 reactions · Opened Jun 22, 2026
docs/examples: reorganize/cleanup our example policies Open

area/documentation

cilium/tetragon#5170 · 1 comment · 1 reaction · 1 assignee · Opened Jun 22, 2026
Proposal: Runtime Causal Enforcement (RCE) in Tetragon Policies Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

cilium/tetragon#5130 · 2 comments · Opened Jun 13, 2026
Detect uprobe binary digest mis-match after the policy has loaded Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

cilium/tetragon#5102 · Opened Jun 3, 2026
Discussion: execve_map and execve_calls tamper protection BPF_MAP_FREEZE and integrity verification Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

cilium/tetragon#5079 · Opened May 31, 2026
selector: `matchParentBinaries` does not work as expected Open

Difficulty 3/5 1-2 days Newbie friendliness 52/100

cilium/tetragon#5069 · 3 comments · Opened May 26, 2026
Documentation: broken links automatic report Open

automated-issue

Difficulty 3/5 1-2 days Newbie friendliness 55/100

cilium/tetragon#5022 · Opened May 19, 2026
uprobe multi-attach does not work properly when a policy contains multiple uprobes that are configured with a mixture of symbols vs addrs/offsets for the same target Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

cilium/tetragon#5005 · 1 comment · Opened May 14, 2026
Incorrect Parent Process randomly reported in some events Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

cilium/tetragon#4999 · Opened May 13, 2026
Improve Windows CI smoke test failure output Open

cilium/tetragon#4991 · 1 assignee · Opened May 12, 2026
Feature: Native DNS query parsing in TracingPolicy, capture queried domain names from udp_sendmsg/udp_recvmsg payloads Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

cilium/tetragon#4948 · 2 comments · 1 reaction · Opened May 4, 2026
check and report faults encountered in read_arg() Open

cilium/tetragon#4923 · 1 comment · 1 assignee · Opened Apr 28, 2026
Make policytests support kfunc detection within WithSkip Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

cilium/tetragon#4913 · 8 comments · Opened Apr 27, 2026
Silent `process_kprobe` attribution loss when `checkprocfs.Check()` fails (Docker Desktop LinuxKit kind on Apple Silicon) Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

cilium/tetragon#4883 · 3 comments · Opened Apr 18, 2026
Unable to write policies against Go string function args Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

cilium/tetragon#4827 · Opened Apr 6, 2026
Perfomance docs and recommendations Open

Difficulty 3/5 1-2 days Newbie friendliness 55/100

cilium/tetragon#4821 · 2 comments · Opened Apr 3, 2026
In-Kernel Policy Metrics: Counting fast events without the log overhead Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

cilium/tetragon#4761 · 1 comment · Opened Mar 13, 2026
ci: `sensors.tracing.TestKprobeMatchParentBinaries` might be flaky Open

area/ci kind/ci-flake

Difficulty 3/5 1-2 days Newbie friendliness 35/100

cilium/tetragon#4751 · 7 comments · Opened Mar 12, 2026
docs: make `matchData` use cases more discoverable Open

area/documentation

cilium/tetragon#4747 · 1 comment · 1 assignee · Opened Mar 9, 2026
Passing large arguments by value breaks argument location assumptions Open

Difficulty 4/5 3-5 days Newbie friendliness 38/100

cilium/tetragon#4685 · Opened Feb 20, 2026
process cache: replace single refcnt with structured ProcessLifecycle for safe cache eviction Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

cilium/tetragon#4665 · 6 comments · Opened Feb 17, 2026
celbpf: evalute CEL expressions in BPF Open

cilium/tetragon#4661 · 1 assignee · Opened Feb 16, 2026
Minor improvement ideas for user space argument preload Open

cilium/tetragon#4646 · 1 assignee · Opened Feb 12, 2026

cilium/tetragon

Get new issues in your inbox