From e23f0fbe5340726ee5a86ad237b9bbf721bca802 Mon Sep 17 00:00:00 2001 From: mayankpande88 Date: Tue, 6 Oct 2026 10:30:16 +0530 Subject: [PATCH] fix: require kernel 5.8, the first with BPF ring buffers L7 events go through a BPF ring buffer, which every program variant uses. The startup check still accepted kernels from 4.16, so on 4.16-5.7 the agent got past it and failed later, loading the programs, with a less clear error. The README said 5.1. The check and the README now say 5.8. --- README.md | 2 +- main.go | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index b9256817..35cd2a6c 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ A per-node observability agent for Kubernetes and Linux hosts. The agent gathers container and host metrics, logs, and L7 traffic using eBPF and exposes them in Prometheus format. -Minimum Linux kernel: **5.1** (eBPF CO-RE). +Minimum Linux kernel: **5.8** (L7 events use a BPF ring buffer). > This project is a fork of > [coroot/coroot-node-agent](https://github.com/coroot/coroot-node-agent) diff --git a/main.go b/main.go index f9bae35a..9ef2708c 100644 --- a/main.go +++ b/main.go @@ -189,8 +189,11 @@ func main() { klog.Exitln(err) } - if !common.GetKernelVersion().GreaterOrEqual(common.NewVersion(4, 16, 0)) { - klog.Exitln("the minimum Linux kernel version required is 4.16 or later") + // L7 events go through a BPF ring buffer (BPF_MAP_TYPE_RINGBUF), which + // every program variant uses and which kernels before 5.8 do not have: + // on them the programs fail to load further on, with a less clear error. + if !common.GetKernelVersion().GreaterOrEqual(common.NewVersion(5, 8, 0)) { + klog.Exitln("the minimum Linux kernel version required is 5.8 or later (BPF ring buffer)") } resolver, err := newIPResolver(hostname)