inspektor-gadget/inspektor-gadget v0.57.0

Release v0.57.0

on GitHub

Welcome to the v0.57.0 of Inspektor Gadget. These are the most important changes:

• Rootless ig run — gadgets can now run without root and without CAP_SYS_ADMIN, needing only cap_bpf, cap_perfmon, and cap_sys_ptrace. Fanotify-based container enrichment still needs CAP_SYS_ADMIN, so ig falls back to reporting events from already-running containers in that mode. A matching --drop-cap-sys-admin flag was added to kubectl-gadget deploy for the same reduced-privilege model in Kubernetes (#5637, #5716).

• OCI local store performance & UX — the local store's index.json no longer grows unbounded; unreferenced manifests are pruned after pulls/builds/removals, and a new ig image prune command reclaims blob disk space. Signature pull failures are now classified into actionable messages instead of raw oras internals (#5782, #5779).

• advise_networkpolicy handles host-network traffic — peers that can't be reliably mapped to a pod (e.g. host-network pods) are now excluded from generated rules and flagged with an annotation instead of producing incorrect policies (#5799).

• Security fix: gRPC-Go DoS (CVE-2026-84445) — bumped google.golang.org/grpc from v1.83.1 to v1.83.2 to patch a HIGH severity xDS server crash vulnerability flagged by Trivy in CI (#5797).

• Breaking changes — snapshot_socket now reports socket state as a human-readable string (e.g. ESTABLISHED, LISTEN) instead of a raw numeric enum, and top_process renamed its CPU/Memory fields to shorter, more consistent names that fit narrow terminals (#5757, #5759).

What's Changed

Breaking Changes

• gadgets/snapshot_socket: Provide human representation of state by @abhishekkhade9137 in #5757
• pkg/operators/process: Shorten CPU and Mem fields in top_process by @abhishekkhade9137 in #5759

General Improvements

• Rootless ig run by @eiffel-fl in #5637
• cmd: Add --drop-cap-sys-admin to deploy subcommand. by @eiffel-fl in #5716
• feat(runtime-finder): add runc path for custom CAPI images built with kubernetes-sigs/image-builder by @fhielpos in #5790
• perf(oci): stop the local store index from growing without bound by @slashben in #5782
• advise_networkpolicy: Handle host network traffic by @mqasimsarfraz in #5799
• operators/ebpf: Hide Parent Tid by @mqasimsarfraz in #5795

Bug Fixes

• fix(oci): make signature pull failures actionable by @slashben in #5779
• deps: bump gRPC-Go to v1.83.2 to address CVE-2026-84445 by @eiffel-fl with @Copilot in #5797

Testing and Continuous Integration

• ci: Add check enforcing consistent gadget docs structure by @NAME-ASHWANIYADAV in #5781
• ci: add non-blocking weekly kernel-compatibility lane for published gadgets by @ErenAri in #5708
• ci: switch to cosign bundle format for signing by @alronova in #5308
• ci: pull the gadget images before the local gadget tests by @alban in #5806
• gadgets/trace_capabilities: Reduce user-stack test flakiness by @burak-ok in #5685
• ci: Remove ttl.sh by @mqasimsarfraz in #5814
• dependabot: Upgrade actions in composite actions by @mqasimsarfraz in #5829
• Artifact Hub: Update gadgets version to v0.56.0 by @github-actions in #5789
• Artifact Hub: Update gadgets version to v0.56.2 by @github-actions in #5817

Dependencies updates

• Bump gopacket to v1.7.3 by @burak-ok in #5818
• go: Bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /tools/testjson2md by @dependabot in #5791
• go: Bump github.com/containerd/containerd from 1.7.33 to 1.7.35 by @dependabot in #5793
• go: Bump github.com/containerd/containerd from 1.7.35 to 1.7.36 by @dependabot in #5811
• go: bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 by @dependabot in #5803
• go: bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc from 0.18.0 to 0.21.0 by @dependabot in #5802
• go: bump the k8s group across 1 directory with 7 updates by @dependabot in #5778
• go: bump the golang-x group across 3 directories with 5 updates by @dependabot in #5827
• go: bump github.com/prometheus/client_golang from 1.24.0 to 1.24.1 by @dependabot in #5735
• go: bump the aws-sdk group across 1 directory with 3 updates by @dependabot in #5838
• go: bump the docker group across 1 directory with 3 updates by @dependabot in #5834
• ci: bump dorny/paths-filter from 4.0.1 to 4.0.3 by @dependabot in #5739
• ci: bump docker/setup-qemu-action from 4.1.0 to 4.4.0 by @dependabot in #5738
• ci: bump azure/login from 3.0.0 to 3.1.0 by @dependabot in #5777
• Dockerfiles: Bump debian from abd67ff to 3783cc0 in /Dockerfiles by @dependabot in #5774
• ci: bump azure/setup-helm from 5.0.0 to 5.0.1 by @dependabot in #5750
• ci: bump docker/build-push-action from 7.3.0 to 7.4.0 by @dependabot in #5823
• ci: bump azure/aks-set-context from 5.0.0 to 5.0.1 by @dependabot in #5826
• ci: bump aws-actions/configure-aws-credentials from 6.2.3 to 6.3.0 by @dependabot in #5824
• ci: bump benchmark-action/github-action-benchmark from 1.22.1 to 1.22.2 by @dependabot in #5825
• ci: bump zizmorcore/zizmor-action from 0.6.2 to 0.6.4 by @dependabot in #5822
• ci: bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @dependabot in #5832
• ci: bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot in #5831
• ci: bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @dependabot in #5833
• ci: bump github/codeql-action/upload-sarif from 4.37.1 to 4.38.2 by @dependabot in #5837
• ci: bump oras-project/setup-oras from 2.0.0 to 2.0.2 by @dependabot in #5830

New Contributors

• @fhielpos made their first contribution in #5790
• @ErenAri made their first contribution in #5708

Full Changelog: v0.56.0...v0.57.0