Coroot is an open-source, eBPF-powered observability platform offering zero-instrumentation monitoring, service maps, SLO tracking, and AI root cause analysis.
Category
DevOps
Pricing
Freemium (free Community Edition + per-core paid tiers), from Free (Community Edition)
Coroot is an open-source observability platform founded in 2021 in Palo Alto, California, by Anton Petruhin, Nikolay Sivko, and Percona co-founder Peter Zaitsev. It uses eBPF, a Linux kernel technology, to automatically collect metrics, logs, traces, and continuous profiles from applications without requiring code instrumentation.
Coroot is released under the Apache 2.0 license with a free, self-hosted Community Edition, plus paid Standard and Premium tiers that add enterprise features like SSO, RBAC, and 24/7 support.
Key Features
eBPF-based zero-instrumentation monitoring automatically builds a real-time service map and observes network and process behavior at the kernel level across every container on a node.
Additional capabilities include SLO tracking, AI-powered root cause analysis, continuous profiling, cloud cost monitoring, deployment tracking, and alerting integrations with Slack, PagerDuty, and Microsoft Teams.
Pricing
The Community Edition is free and open source, suitable for self-hosted development and smaller production clusters. The Standard paid tier costs $1 per monitored CPU core per month with volume discounts and no data-volume-based fees, adding SSO, RBAC, and business-hours support.
A Premium tier with 24/7 support, phone support, capacity planning, air-gapped installation, and team training is available through direct sales contact, and a 14-day trial is offered for paid tiers.
Key Features
eBPF Zero-Instrumentation Monitoring — Automatically collects metrics, logs, traces, and profiles at the kernel level without requiring code changes, SDKs, or manual instrumentation.
Automatic Service Maps — Builds a real-time topology map of application services and their dependencies based on observed network traffic.
SLO Tracking — Defines and tracks service-level objectives to monitor reliability against agreed targets.
AI-Powered Root Cause Analysis — Correlates signals across metrics, logs, traces, and profiles to help engineers move quickly from an anomaly to a likely cause.
Continuous Profiling — Captures ongoing performance profiles of running applications to support performance troubleshooting.
Cloud Cost Monitoring — Tracks infrastructure cost alongside performance data to connect spend with resource usage.
Smart Alerting — Sends alerts to Slack, PagerDuty, and Microsoft Teams based on anomaly detection and SLO breaches.
Deployment Tracking — Correlates new deployments with subsequent changes in performance or error rates.
Pros & Cons
Pros
No code instrumentation required — eBPF collects telemetry automatically at the kernel level
Generous, genuinely free-forever self-hosted Community Edition for development and smaller production clusters
Predictable per-core pricing with no separate data-volume fees, unlike many usage-based observability vendors
Strong Kubernetes-native fit with automatic service mapping across polyglot service fleets
Cons
Smaller integration ecosystem and community than established players like Datadog, New Relic, or Grafana
eBPF requires sufficient Linux kernel support and permissions, which can complicate deployment in some restricted environments
Enterprise features such as 24/7 support and air-gapped installation are reserved for the higher-priced Premium tier
Young, small company (founded 2021, reportedly under 10 employees) relative to legacy APM vendors
Pricing
Community Edition Free N/A
Standard $1 per CPU core/month Monthly
Premium Custom Contact Sales
Frequently Asked Questions
Is Coroot free?
Yes. Coroot's Community Edition is fully open source, self-hosted, and free to use indefinitely, including for production Kubernetes clusters.
What license is Coroot released under?
Coroot is released under the Apache 2.0 open-source license.
Does Coroot require code changes to install?
No. Coroot uses eBPF to observe applications at the kernel level, so it does not require adding tracing SDKs or instrumentation code to your services.
What is eBPF and why does Coroot use it?
eBPF is a Linux kernel technology that allows safe, sandboxed programs to run inside the kernel to observe system and network behavior. Coroot uses it to automatically collect metrics, logs, traces, and profiles without manual instrumentation.
Can Coroot replace a hand-assembled Prometheus/Grafana stack?
Coroot is designed to replace much of the manual setup involved in assembling Prometheus, Grafana, and tracing tools separately, by providing automatic collection and correlation out of the box.
Does Coroot support non-Kubernetes environments?
Coroot is primarily designed and marketed for Kubernetes environments, where it deploys as a node-level agent observing every container on a node.