Skip to main content

Kernel

Linux kernel 4.18+ (RHEL/CentOS/Rocky 8, Ubuntu 20.04, or newer).
  • 5.8+ with native BTF (CONFIG_DEBUG_INFO_BTF=y): /sys/kernel/btf/vmlinux is used directly — the preferred CO-RE path.
  • 4.18–5.7: the release tarball includes bundled minimal BTF files under btf/; the agent uses these when native BTF is absent.
At startup the agent auto-detects the kernel version and selects the BPF backend (modern for 5.11+, legacy for 4.18–5.10). Cgroup v1 and v2 are both supported.
The openat2 file-open event type is only available on kernel 5.6+. On older kernels, the standard openat event type covers all file opens — coverage is equivalent for detection, but event typing differs.

Architecture

x86_64 or aarch64 (Graviton). A separate tarball ships per architecture; the container image is multi-arch.

Privileges

  • VMs: root
  • Kubernetes: privileged: true containers

Outbound network

HTTPS (443) to your DAG_SHIP_URL. On AWS / Azure / Ali Cloud that is a private link endpoint (PrivateLink or equivalent). On GCP v1 it is https://{name}-ingest.hilt.ai on the GKE HTTPS Gateway — see GCP.

Memory

Measured in production: 4–6 MB RSS steady state.

CPU

< 1% of a single core under typical workloads; ring buffer and userspace filtering smooth spikes.

Supported distributions

The unified agent supports every major distribution in production:
  • Amazon Linux 2 (kernel 5.10) and Amazon Linux 2023
  • Ubuntu 20.04+ (HWE) / 22.04 / 24.04
  • RHEL 8+ / Rocky / Alma
  • Debian 11+
  • Bottlerocket
  • Flatcar
  • EKS-optimized AMIs
Kernels 5.8+ with native BTF are preferred. Kernels 4.18–5.7 rely on the bundled BTF in the release tarball — no separate BTF drop-in is required for supported legacy kernels.
Last modified on October 8, 2026