> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aiaxoniq.com/llms.txt
> Use this file to discover all available pages before exploring further.
# OpenTelemetry OBI
> The upstream project behind zero-code instrumentation, which version is pinned, and every default this distribution deliberately changes — with the reason for each.
The agent is **OpenTelemetry eBPF Instrumentation (OBI)**, an
OpenTelemetry project, shipped here **unmodified and version-pinned**. It is
Apache-2.0, and its `LICENSE` and `NOTICE` are preserved on install. Upstream
publishes a CycloneDX SBOM per release.
**Availability.** The zero-code agent is an early-access distribution. It is
installable, upgradable and tested, and it is **not yet an integrated part of
the product**: there is no dashboard page for it, no in-product installer and
no self-service download. Ask your account contact for access.
Its telemetry, once flowing, is ordinary OTLP and needs nothing special —
it appears in Services, Traces and Metrics exactly like SDK telemetry does.
That is the design rather than a shortcut.
## What "unforked" means, and why it is the claim to check
Most eBPF agents on the market are proprietary binaries that *emit*
OpenTelemetry. This one *is* the OpenTelemetry one.
The practical difference is portability. Because the binary carries nothing
aiAxonIQ-specific, the same agent, with one endpoint changed, exports to any
OpenTelemetry backend. Adopting it is not a decision you have to unwind later.
**This is a testable claim, not a positioning statement.** Change the
endpoint and credential in the configuration, point them at any OTLP
collector you like, and watch the same spans arrive. If you are comparing
vendors, that is the experiment worth running against each of them.
## What this distribution adds
Everything aiAxonIQ contributes sits *around* the binary:
| | |
| :---------------------------- | :--------------------------------------------------------------------------------------------------------- |
| **Opinionated configuration** | Route unification (the cardinality guard), health-endpoint filtering, batching sized to real ingest limits |
| **Capability profiles** | Three named privilege levels, chosen deliberately rather than defaulting to permissive |
| **Preflight checker** | Tells you *before* installing whether a host can work, and names the specific reason it cannot |
| **Packaging** | systemd, Docker, Compose, Helm — plus the OpenShift SecurityContextConstraints upstream does not ship |
| **Configuration generator** | You never hand-write agent YAML |
| **Diagnostics** | Health, connectivity, config validation, a security audit, and a redacted support bundle |
## Every default that is changed
Each is a deliberate departure, argued where it is made:
| Upstream default | Here | Why |
| :--------------------------- | :----------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Helm `privileged: true` | `privileged: false` | A privileged container has effectively unrestricted host access. That is not what an operator thinks they agreed to when installing an observability agent. |
| Context propagation enabled | Disabled on the lower two profiles | Enabling it silently adds `CAP_NET_ADMIN`, host networking and a tracefs mount — **upstream's default is this distribution's highest profile.** Choosing "recommended" should not grant network administration on every node. |
| Unmatched routes unset | Heuristic route patterns | Raw wire paths turn one endpoint into a million metric series. See [cardinality](/concepts/data-model#cardinality-is-the-cost-you-cannot-see). |
| No ignored routes | Health and metrics endpoints dropped | High frequency, no diagnostic value, a large share of total volume. |
| Default batching | Tuned to real ingest limits | A DaemonSet fleet is N exporters spending **one** organization's rate-limit budget. |
| Capability enforcement unset | Enforced | A misconfiguration should prevent start, not degrade invisibly. |
| Floating image tag | Pinned version | Never float a tag on an agent holding kernel capabilities. |
| No OpenShift SCC | One ships | Otherwise every OpenShift operator writes one by hand, or gives up and runs privileged. |
**Upstream's published capability lists are incomplete for the pinned
release, and this was established by running the binary rather than reading
about it.**
* Upstream's **application** line omits `CAP_CHECKPOINT_RESTORE`. The agent
refuses to start without it. Loud, and quickly diagnosed.
* Upstream's **network** line omits `CAP_PERFMON`. With exactly the
documented set, the agent's own gate passes and the *kernel* then rejects
the socket filter. The agent comes up, reports healthy, and produces
nothing.
The second is the dangerous one, and an operator carefully following
upstream's least-privilege guidance lands exactly there. The profiles here
are **measured** against the pinned release, not copied from documentation.
## Version pinning
The upstream version, the chart version and the capability sets are pinned
together, because they are one fact rather than three. Changing the pinned
version is a deliberate act that requires the capability requirements to be
**re-measured** — they are a property of the binary, not of its documentation.
**Older upstream releases are not supported here.** Releases before the
pinned one use a different configuration schema and their capability
requirements were never measured. Newer ones are likely compatible but
unverified until measured. Your account contact can tell you what the current
pinned version is for the distribution you have.
## Licensing
Upstream OBI is Apache-2.0. This distribution's own packaging is Apache-2.0.
**The distribution downloads upstream artefacts at install time and
redistributes no binary**, verifying them against published checksums. That
is a deliberate position while the GPL implications of *redistributing* eBPF
binaries are under legal review — it keeps the question open rather than
answered in advance.
The practical consequence for you: **installation requires outbound access to
the upstream release host**, once, at install time. Fully air-gapped
environments need the artefacts staged in advance — talk to your account
contact.
## Next
What runs where, and how telemetry reaches aiAxonIQ.
The three privilege levels, measured against the pinned release.
Kernels, distributions, clouds and runtimes.