# Capture low-level Kubernetes runtime evidence with Inspektor Gadget

> Run named Inspektor Gadget traces and snapshots when an agent needs eBPF-backed runtime evidence from pods, containers, or nodes that ordinary logs and metrics do not expose.

- Skill: `agentskillexchange/capture-low-level-kubernetes-runtime-evidence-with-inspektor` (Agent Skill)
- Install (CLI): `npx skillmds@latest add agentskillexchange/capture-low-level-kubernetes-runtime-evidence-with-inspektor`
- Raw SKILL.md: https://api.skillmd.com/api/skills/agentskillexchange/capture-low-level-kubernetes-runtime-evidence-with-inspektor/raw
- Safety review: pending (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: agentskillexchange (https://skillmd.com/u/agentskillexchange)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/agentskillexchange/capture-low-level-kubernetes-runtime-evidence-with-inspektor

---


# Capture low-level Kubernetes runtime evidence with Inspektor Gadget

Run named Inspektor Gadget traces and snapshots when an agent needs eBPF-backed runtime evidence from pods, containers, or nodes that ordinary logs and metrics do not expose.

## Prerequisites

Inspektor Gadget installed on Kubernetes or Linux with permissions to run gadgets

## Installation

Use the upstream install or setup path that matches your environment:
- docker run -ti --rm --privileged -v /:/host --pid=host ghcr.io/inspektor-gadget/ig:latest run trace_open:latest

Requirements and caveats from upstream:
- ### Kubectl Node Debug
- We can use [kubectl node debug](https://kubernetes.io/docs/tasks/debug/debug-cluster/kubectl-node-debug/) to run ig on a Kubernetes node:
- kubectl debug --profile=sysadmin node/minikube-docker -ti --image=ghcr.io/inspektor-gadget/ig:latest -- ig run trace_open:latest

Basic usage or getting-started notes:
- Security mechanisms to restrict and lock-down which Gadgets can be run
- The following examples use the [trace_open](https://www.inspektor-gadget.io/docs/latest/gadgets/trace_open) Gadget which triggers when a file is open on the system.
- ### Kubernetes

- Source: https://github.com/inspektor-gadget/inspektor-gadget
- Extracted from upstream docs: https://raw.githubusercontent.com/inspektor-gadget/inspektor-gadget/HEAD/README.md

## Documentation

- https://inspektor-gadget.io/docs/latest/reference/run/

## Source

- [Agent Skill Exchange](https://agentskillexchange.com/skills/capture-low-level-kubernetes-runtime-evidence-with-inspektor-gadget/)