What is Linnix?

Linnix is an eBPF-based Linux observability tool that goes beyond traditional metrics by attributing system stalls to specific processes and Kubernetes pods. It uses kernel-level eBPF probes combined with Pressure Stall Information (PSI) to detect noisy neighbors, fork storms, memory leaks, and short-lived job churn. The agent (cognitod) runs as a DaemonSet on Kubernetes or via Docker Compose on bare metal, exposing a Prometheus-compatible metrics endpoint and a REST API for investigation. An optional local LLM provides natural-language incident explanations. All analysis happens on your infrastructure with no mandatory data egress. The project is licensed AGPL-3.0 for the agent and GPL-2.0 OR MIT for the eBPF collector, with commercial licensing available.

Should you self-host Linnix?

Linnix scores 45/100 on selfhost.directory (how scoring works) and ranks #17 of 19 in Infrastructure Monitoring. It has 252 GitHub stars.

It shipped 3 stable releases in the past year. The latest, v0.2.0, came out on 26 November 2025. New versions land roughly every 10 days.

Setup is advanced: plan for several services and some ongoing maintenance. An official Docker image is available. It is Other-licensed and written mostly in Rust.

Its closest alternative on selfhost.directory is Beszel (81/100, 26 612 stars). It scores higher overall, so compare the two before you pick. See Linnix vs Beszel side by side.

Features

CLI investigation tool
Data privacy controls
eBPF-based kernel monitoring
Fork storm detection
Kubernetes pod attribution
Local AI incident explanationOptional, disabled by default; requires 2.1GB model download
MCP server for AI agents
Memory leak detection
Monitor-first safety
Noisy neighbor detection
Prometheus metrics export
PSI stall attribution
Short-lived job detection

FAQ

Can I disable the AI reasoner?

Yes. Set the reasoner endpoint to empty in linnix.toml or stop the LLM container. The daemon keeps emitting rule hits and raw events over JSON/SSE; you only lose natural-language summaries.

How much overhead should I expect?

eBPF probes add under 1% CPU. Full cognitod daemon uses ~3.6-4.1% of one core and 10-20 MB RAM on typical hosts.

How do I tell whether Linnix is actually collecting?

Check /readyz endpoint: returns 503 when eBPF probes are not attached with a reason. /healthz always returns 200. Scrape linnix_kernel_instrumentation_active metric (1=probes attached, 0=userspace-only).

What kernel versions are supported?

Minimum Linux 5.12 on x86_64 and 5.18 on arm64/aarch64. Recommended 5.15+ (x86_64) / 6.1+ (arm64) with BTF packages. Below minimum, eBPF probes fail to load and Linnix runs in userspace-only mode without per-process attribution.