To investigate a suspicious or failing container, a team may need information about the processes and system activity underneath it. The commercial Sysdig agent collects those signals and connects them to Sysdig’s monitoring and security services, with additional scanning components available for selected use cases. Its node-level visibility requires specific kernel support and host permissions. Choose the required features and driver deliberately, then verify both the signals collected and any response policies that could disrupt workloads.
Current guidance
This entry describes the commercial Sysdig monitoring and security agent, distinct from simply running the open-source sysdig command. Current vendor documentation uses Helm for supported Kubernetes installation and distinguishes runtime detection, host scanning, image scanning and cluster-level components. Select the intended feature set and regional backend rather than enabling every component through an old stable-chart example.
The driver guide prefers Universal eBPF and checks specific kernel capabilities such as BTF and ring buffers; a kernel version number alone is not a complete compatibility test. It also announces legacy eBPF retirement on December 4, 2026. Confirm the driver against the actual node distribution, managed-cluster restrictions and agent version before upgrading nodes or changing chart values.
Review required host access, admission exceptions and response policies because the agent can observe sensitive processes and some policies can take disruptive actions. Rehearse on a bounded node pool, validating event capture, dropped events, memory and backend identity. Preserve rules and exceptions during migration, and confirm that a successful agent connection also means the required security signals and scanners are functioning.
Historical upstream link check · 2026-10-09
Automated availability verification was inconclusive on 2026-10-09 (connection or verification failure). Link availability does not certify the historical installation instructions or current security support.
Website availability is separate from project, chart and image support. Use the current guidance and primary sources on this page to assess the distribution.
Historical Kubedex content
Preserved for context. Commands, versions, prices and results below reflect the original research.
Sysdig is a unified platform for container and microservices monitoring, troubleshooting, security, and forensics. The sysdig platform has been built on top of Sysdig tool and Sysdig Inspect open-source technologies. This chart adds the Sysdig agent for Sysdig Monitor and Sysdig Secure to all nodes in your cluster via a DaemonSet.
Why Sysdig?
Accelerate your transition to containers, and then have confidence in your ongoing operations. We’ve built the cloud-native intelligence platform to create a single, more effective way to secure, monitor, and assure you’re critical applications.
Cloud-native advantages
Sysdig is the only platform architected to use cloud-native intelligence for monitoring and securing all your applications. Develop with confidence.
Better, richer data
We’ve unlocked a new data source to give you better data – and more of it. With Sysdig you get the true visibility you need to resolve issues and block threats.
Unified Instrumentation
Only Sysdig has unified the actual system instrumentation that drives security, monitoring, and forensics. That means you solve problems faster with lower server agent overhead and less management.
Enterprise-class functionality
Everything we build is designed for enterprises that will eventually need large-scale deployment, with the security and management features to go along with it.
Run it anywhere.
The Sysdig Cloud-Native Intelligence Platform is available both as cloud and on-premises software offerings. We even can run in air-gapped environments. Get the same features and functionality, wherever you want to run our products.
Sysdig Secure
Bring together image scanning and run-time protection to identify vulnerabilities, block threats, enforce compliance, and audit activity across your microservices.
Why Sysdig Secure?
Secure you protect and assure your applications. We bring together image scanning, run-time protection, and forensics to identify vulnerabilities, block threats, enforce compliance, and audit activity across your microservices.
- Vulnerability Management: Identity, remediate, and mitigate vulnerabilities from deployment to production. Scan images in a registry or as part of the CI/CD process to uncover vulnerable libraries, packages, and configuration. Create vulnerability policies to fail builds, prevent images from running, and get alerted of new vulnerabilities in production.
- Run-time Detection: Sysdig ContainerVision collects data through system calls, giving you 10x more signals about container, host and orchestrator activity in your environment. Our behavioral models leverage data from the millions of containers we already protect to create the most effective out-of-the-box container protection and response for you.
- Compliance: 250+ out of the box compliance checks to keep your configuration secure.
- Detect violations of external compliance requirements like CIS, PCI-DSS, GDPR, or enforce custom compliance controls. Leverage sysdig captures to record and store all data surrounding any violation for complete governance and risk management.
- Forensics: Record a snapshot of all activity before and after security events.
- Record pre- and post-attack activity through system calls with microsecond-level granularity. Our forensics allow you inspect data outside of production, even if the containers are long gone. Easily recreate intrusions, data exfiltration events, or lateral movement so you can recover quickly and improve your defensive posture.
- Audit: Track every command executed on hosts and inside containers
- Capture audit trails of every user action taken on your hosts or inside your containers with full command-line arguments, enriched with container and orchestrator context. Easily integrate audit trails downstream for simplified management.
Sysdig Monitor
See how you can combine deep container visibility, rich Kubernetes & Docker metadata, and Prometheus integration. Get better application monitoring, alerting, and troubleshooting than you’ve ever had before.
Why Sysdig Monitor?
Sysdig Monitor gives you the most complete approach to monitoring and troubleshooting containers and Kubernetes. With Monitor, you can enhance software reliability and accelerate problem resolution, with advanced Kubernetes integration and built-in Prometheus monitoring capabilities.
- Full stack data analysis: Response times, application performance metrics, custom metrics, container, server, and network utilization metrics, and even orchestrator metrics. See it all in one place from just one instrumentation point per host.
- Exploration: It’s like htop for your entire infrastructure. Group data by host and container, or use metadata from Docker, Kubernetes, Mesos, and AWS to view everything by microservice. Drill down into pre-built views to quickly see important metrics.
- Dashboarding: Build full-stack dashboards to visualize your applications, microservices, containers, networks, and more. Easily correlate Docker events, CI / CD events, code commits, Kubernetes events, alerts, and more.
- Adaptive Alerting: Set fine-grained conditions and use anomaly detection so you know instantly if there’s a problem
- Build alerts across namespaces, clusters, labels, metrics, or any tag. Alert per-container, per-host or the entire environment. Use outlier detection to simplify monitoring. Send notifications to PagerDuty, Slack, VictorOps, email, or just about anywhere via webhooks. Even the trigger system captures to record all activity for offline troubleshooting.
- Custom Metrics: Automatically collect Prometheus, StatsD and JMX metrics from services, apps, and containers without a server endpoint or complex configs. Aggregate and visualize data by microservice or cluster on-the-fly.
- Teams: Isolate and secure data and dashboards by the team, user, customer or environment. Provide explicit access to containers, namespaces, services, hosts and more.
- In-depth Troubleshooting: See root cause even after containers are long gone.
- Other systems stop at the chart. We go deeper. Trigger captures of system call for offline troubleshooting. Get deep views per process, container, connection …even down to payload.
Sources & further reading
Spotted something that needs another look?
Help improve this page →