Skip to content

Coroot

Open-source, eBPF-powered observability and APM platform with zero-instrumentation auto-discovery, AI-powered root cause analysis, and continuous profiling.

Overview

Coroot is a zero-instrumentation observability platform that leverages eBPF to collect metrics, logs, traces, and continuous profiles directly at the kernel level — without code changes, SDK installations, or application restarts. It focuses on reducing Mean Time to Resolution (MTTR) through automated service map discovery and AI-powered root cause analysis.

Repository & Community

Attribute Detail
Repository github.com/coroot/coroot
Stars ~7.6k ⭐
Latest Version v1.19.2 (April 10, 2026)
Language Go
License Apache 2.0 (Community), Proprietary (Enterprise)
Company Coroot, Inc.

Evaluation

  • Why it's better: The only open-source platform that provides eBPF-based auto-instrumentation across all 4 pillars (metrics, logs, traces, profiles) with zero code changes. AI-powered root cause analysis dramatically reduces MTTR. Automatically discovers and maps all services, databases, and external API dependencies.

  • When it fits (Applicability):

  • Teams wanting observability without instrumenting every service
  • Kubernetes-native environments needing automatic service discovery
  • Organizations seeking to minimize MTTR with AI-driven diagnostics

  • Small-to-medium teams without dedicated platform engineering

  • Pros and Cons:

Pros Cons
Zero instrumentation required (eBPF) Requires Linux kernel 4.16+ for eBPF
Auto-generated service maps Younger project, smaller community
AI root cause analysis Enterprise features behind paywall
Continuous profiling included Less customizable dashboards vs Grafana
Apache 2.0 (community) eBPF data may miss application-level context
Multi-cluster support No built-in log management (uses ClickHouse/Prometheus)

Architecture

flowchart TB
    subgraph Agents["Data Collection"]
        NA["coroot-node-agent<br/>(eBPF DaemonSet)"]
        CA["coroot-cluster-agent<br/>(DB discovery)"]
        OTEL["OTel SDK<br/>(optional)"]
    end

    subgraph Core["Coroot Server"]
        direction TB
        Inspect["Automated Inspections<br/>& AI RCA"]
        SM["Service Map Engine"]
        Cache["Metric Cache<br/>(on-disk)"]
        UI["Web UI"]
    end

    subgraph Storage["Storage Backends"]
        Prom["Prometheus / VM / Mimir"]
        CH["ClickHouse<br/>(logs, traces, profiles)"]
    end

    NA --> Core
    CA --> Core
    OTEL --> Core
    Core --> Prom
    Core --> CH
    Inspect --> UI
    SM --> UI

Key Components

Component Role
coroot-node-agent eBPF DaemonSet: collects metrics, logs, traces, profiles at kernel level
coroot-cluster-agent Discovers databases (Postgres, MySQL, Redis, MongoDB) and collects internal metrics
Coroot Server Aggregation, automated inspections, AI analysis, visualization
Storage Prometheus/VictoriaMetrics/Mimir for metrics; ClickHouse for logs, traces, profiles

Key Features

Feature Detail
eBPF Collection Kernel-level telemetry without code changes
Service Map Auto-discovery of services, databases, external APIs
Continuous Profiling CPU and memory profiling down to specific code lines
Distributed Tracing eBPF auto-traces + OTel SDK support
SLO Monitoring Built-in SLO compliance tracking
Cloud Cost Insights Per-application resource and cost breakdown
AI Root Cause Analysis Automated pattern detection and fix suggestions
Multi-Cluster Unified view across multiple K8s clusters
Log Analysis Aggregation and analysis via ClickHouse backend

Pricing

Tier Cost Features
Community Free (Apache 2.0) Core observability, eBPF, service maps, SLO, profiling
Enterprise $1/CPU core/month AI RCA, SSO, RBAC, 24x7 support, air-gapped deployments

Compatibility

Dimension Support
Metrics backends Prometheus, VictoriaMetrics, Thanos, Grafana Mimir
Log/trace storage ClickHouse
Ingestion protocols OTLP (logs, traces), Prometheus Remote Write
Platforms Kubernetes, Docker, bare metal (Linux only, kernel 4.16+)
CPU architecture amd64, arm64

Sources