Coroot - Secure eBPF Observability and APM AMI by cloudimg

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Coroot is an open source, eBPF-based observability and application performance monitoring (APM) platform. A zero-instrumentation node agent uses eBPF to collect metrics, distributed traces, logs and continuous profiles directly from the Linux kernel - no code changes or SDKs required - and Coroot correlates them into automatic service maps, latency and error dashboards, SLO tracking and cost monitoring, all in a built-in web UI. This AMI delivers a fully installed, security-hardened Coroot Community Edition appliance so a working observability stack is operational within minutes of launch, running entirely in your own AWS account.

This image eliminates the multi-container orchestration, reverse-proxy configuration, datastore tuning and credential hardening that a bare install requires. Coroot is delivered as four official upstream containers - the Coroot server, the privileged eBPF node agent, a bundled Prometheus store and a bundled ClickHouse store for traces, logs and profiles - pinned by image digest and run unmodified under a single systemd unit on a private Docker network. An nginx reverse proxy fronts the web UI, and a unique Coroot admin password (plus a unique ClickHouse password) is generated on each instance's first boot, so no two deployments share a credential and nothing is baked in. Launch the instance, read your unique credential, and the node agent begins populating the service map with real telemetry automatically.

The Coroot server and web UI, the eBPF node agent, Prometheus and ClickHouse run as pinned-by-digest containers via docker compose under one systemd service on a private network. The Coroot server binds to loopback only; Prometheus and ClickHouse are never published to a host port. An nginx reverse proxy on port 80 forwards to the Coroot UI and exposes an unauthenticated health endpoint for load-balancer probes. All container data - the Coroot store, ClickHouse, Prometheus and the node-agent write-ahead log - lives on a dedicated, resizable EBS data volume mounted at the Docker data-root, off the OS disk. systemd starts the stack on boot and restarts it on failure.

This image follows a defence-in-depth approach:

• Network isolation: the Coroot server binds to loopback and the datastores (Prometheus, ClickHouse) are never published to a host port; only the nginx reverse proxy and SSH are reachable
• Authentication enforced: Coroot's built-in authentication is active, so the dashboard and API are never served anonymously except an unauthenticated health endpoint for load-balancer probes
• No default or shared credentials: a cryptographically random admin password and a separate ClickHouse password are generated on each instance's first boot and written only to a root-only file
• Clean capture: the image ships with no database, no admin user and no telemetry - every instance re-initialises a fresh store and admin on first boot, and the four containers are locked by image digest

Buyers requiring formal compliance documentation should contact cloudimg to discuss specific requirements.

• Zero-instrumentation APM for microservices: A platform team launches the appliance alongside their services and gets an automatic service map with per-service latency, error rate and throughput dashboards from the eBPF agent, without adding a single line of instrumentation code
• Incident detection and SLO tracking: An SRE team defines availability and latency SLOs and watches Coroot surface anomalies, slow database queries and failing dependencies from the correlated metrics, traces and logs during an incident
• Continuous profiling and cost visibility: An engineering team uses the built-in CPU and memory profiling to find hot code paths, and the cost monitoring view to attribute cloud spend to applications and nodes

Deploy on any EC2 instance type that meets the datastores' memory needs; m5.large or larger is recommended. Grow the EBS data volume as retention needs increase, use the health endpoint with an Application Load Balancer, and snapshot the data volume with AWS Backup. Coroot self-monitors the instance it runs on, so the service map populates automatically once the instance is up.

Read your credential from the root-only file, open the web interface, sign in as the admin user, and watch the service map and dashboards fill with the instance's own telemetry within a couple of minutes. Install the node agent on your other hosts to widen coverage.

24/7 technical support by email and chat. Help with deployment, reverse-proxy TLS termination with your own domain, widening telemetry coverage, datastore tuning, and interpreting service maps, traces and SLOs.