TigerGate Docs — code-to-cloud security platform

TigerGate is TigerGate’s runtime sensor — an eBPF agent (a Cilium Tetragon fork) that runs one instance per node or host. It watches process, file, network, and privilege events in the kernel and streams them to TigerGate as runtime events and policy violations. It’s the only TigerGate component that runs inside your infrastructure. On Kubernetes it installs with the same Helm chart as KSPM.

Requirements

Linux kernel 5.4+ with BTF (standard on modern distros — Ubuntu 20.04+, RHEL 8.2+, etc.).
Runs privileged with host PID and the kernel bpf/debug filesystems mounted.
An org API key (tg_…) — Dashboard → Settings → API Keys.
Outbound 443 to your region’s Ingest host, and to its API host for the policy pull.

Pick your region

The sensor streams kernel events out of your infrastructure, so the region it ships to is a data-residency decision, not a convenience setting. Every install method below takes one. Omit the region for us1, the default — that’s what every install did before regions existed. See Regions.

Run it

Kubernetes (Helm)
Linux host (bare metal / VM)
Docker

The sensor ships in the unified tigergate chart and is on by default (sensor.enabled=true):

helm install tigergate oci://registry.tigergate.dev/charts/tigergate \
  --namespace tigergate-system --create-namespace \
  --set backend.apiKey=tg_<org-api-key> \
  --set clusterName=my-cluster
# add --set region=<code> unless your organization is in us1

Then turn on event shipping (off by default — see Configuration):

helm upgrade tigergate oci://registry.tigergate.dev/charts/tigergate \
  --namespace tigergate-system --reuse-values \
  --set 'sensor.extraArgs[0]=--export-filename=/var/run/tigergate/events.log' \
  --set 'sensor.extraArgs[1]=--enable-k8s-api=true' \
  --set 'sensor.extraArgs[2]=--enable-tracing-policy-crd=false'

Runtime only — without KSPM

To run just the sensor (no KSPM posture scanning or admission control), install the same chart with the KSPM components off:

helm install tigergate oci://registry.tigergate.dev/charts/tigergate \
  --namespace tigergate-system --create-namespace \
  --set backend.apiKey=tg_<org-api-key> \
  --set clusterName=my-cluster \
  --set controller.enabled=false \
  --set admission.enabled=false \
  --set 'sensor.extraArgs[0]=--export-filename=/var/run/tigergate/events.log' \
  --set 'sensor.extraArgs[1]=--enable-tracing-policy-crd=false'

This installs only the tigergate-sensor DaemonSet. It ships events straight to your region’s ingest endpoint and pulls policies from the backend — no operator, webhook, or posture scanning.

Pod / namespace enrichment (--enable-k8s-api=true) needs the cluster read-RBAC that ships with the operator. Running sensor-only, either leave it off (events carry container IDs) or keep the operator installed but muted with --set blockKspm=true.

Full chart reference: Install the KSPM agent with Helm.

Install the sensor directly — it runs as a systemd service:

curl -fsSL https://download.tigergate.dev/tigergate-sensor/install.sh | sudo bash -s -- \
  --api-key tg_<org-api-key> --cluster my-host \
  --region <code>          # omit for us1

The installer resolves the endpoints from --region (or TIGERGATE_REGION), records the resolved region in /etc/tigergate/sensor.env, and refuses to start on an unknown code rather than falling back. --backend-url overrides both, for a self-hosted or staging platform.Manage it with systemctl status tigergate / systemctl restart tigergate.

Run the sensor image on the host (outside Kubernetes):

docker run -d --name tigergate \
  --privileged --pid=host --cgroupns=host \
  -e TIGERGATE_API_KEY=tg_<org-api-key> \
  -e TIGERGATE_CLUSTER_NAME=my-host \
  tigergate/tigergate-sensor:latest \
  --export-filename=/var/run/tigergate/events.log \
  --enable-tracing-policy-crd=false

Standalone Docker has no region flag — pass the two endpoints for your region explicitly with -e TIGERGATE_INGEST_GRPC_ADDR=… and -e TIGERGATE_BACKEND_URL=… (see Configuration). Leave them out only on us1.

Configuration

The sensor is configured with environment variables:

Variable	Default	Purpose
`TIGERGATE_API_KEY`	—	Org `tg_` key. Required — the sensor stays inert without it.
`TIGERGATE_CLUSTER_NAME`	`default`	Name this node / cluster reports as.
`TIGERGATE_INGEST_GRPC_ADDR`	`sensor.tigergate.dev:443` (`us1`)	Where event batches are shipped. Set it to your region’s Ingest host, or let Helm / the host installer derive it from the region.
`TIGERGATE_BACKEND_URL`	`https://api.tigergate.dev` (`us1`)	Control-plane heartbeat + policy pull. Your region’s API host.
`TIGERGATE_OPERATOR_ADDR`	—	Optional. Pull policies via the in-cluster KSPM operator relay instead of the backend.
`TIGERGATE_HEARTBEAT_SECONDS`	`30`	Heartbeat / policy-poll interval.

A few sensor flags matter (pass via sensor.extraArgs on Helm, or on the command line elsewhere):

Flag	Purpose
`--export-filename=<path>`	Required to ship events — export is off by default. Any writable path works (a rotated JSON log).
`--enable-k8s-api=true`	Tag events with pod / namespace / container (Kubernetes only).
`--enable-tracing-policy-crd=false`	TigerGate delivers policies from the dashboard, not CRDs — leave off.

--set sensor.extraArgs[N]=… replaces the whole list — pass every flag you want in one command, not just the one you’re adding.

Audit vs. enforce

Runtime policies are managed in Dashboard → Runtime → Enforcement and pulled by every sensor every 30 seconds — no restart or reinstall to change them.

Monitor (audit) — record the event, allow the operation. The starting mode.
Block (enforce) — block the operation inline (kernel 5.4+). Flip per policy once you trust it.

See Custom policies to write your own.

Verify

# Kubernetes
kubectl -n tigergate-system logs -l app.kubernetes.io/component=sensor -f
# Linux host
sudo systemctl status tigergate

The node appears in Dashboard → Runtime within ~30 seconds of startup.

​Requirements

​Pick your region

​Run it

​Configuration

​Audit vs. enforce

​Verify

Requirements

Pick your region

Run it

Configuration

Audit vs. enforce

Verify