Host onboarding and kernels

Capture comes from an agent on the host. This page covers support, privileges and verification.

Kernels and distributions

Kernel 3.10 and later
Native eBPF on 4.18 and later
Kernels without BTF use compatibility objects. Fewer capabilities, never silent success
Validated distributions include CentOS 7, Rocky 8, Ubuntu 20.04 to 26.04, Debian 12/13, openSUSE 15.6, openEuler 24.03 and Kylin V10

Privileges

Installing requires root. The installer:

mounts debugfs and tracefs
raises RLIMIT_MEMLOCK
installs the policy module on EL7 with SELinux enforcing
writes and starts the systemd unit

Running without root still keeps the agent online, but capture, profiling and chaos report degraded or unsupported, with the reason in the heartbeat and lane status.

Containers

Docker, containerd and Kubernetes
cgroup v1, v2 and hybrid layouts are recognized
gVisor and Kata are out of scope

Verify

sudo ./install.sh
diting-agent probe
curl -s localhost:<agent-port>/kernel-capabilities | jq

probe reports the actual privileges of the running process. /kernel-capabilities describes kernel support. When they disagree, trust probe and the heartbeat.

Known limitations

arm64 eBPF has not been exercised on real hardware; there is cross-build and simulator smoke coverage only
When native on-CPU or off-CPU profiling is unavailable, the fallback is still being completed. Profiling reports degraded instead of sampling silently
Compatibility lanes have no full connection tracking, so some causality fields are missing

These show up in host status. They are not hidden.

Rollout order

Start with one non-critical host and confirm capability and overhead
Install by host group
Enable resource-heavy features such as TLS plaintext and profiling last