File contents
The agent never reads the contents of your files. It reads metadata, package versions and counters.
What the agent reads
A single static Go binary, Linux only, with no external dependencies. Here is every source it touches.
What it reads
| SOURCE | WHAT FOR |
|---|---|
| /proc | CPU, load, memory and uptime |
| statfs | Disk usage per mount point |
| The package database | Installed versions, to match against advisories |
| Listening sockets | The port baseline, incoming and outgoing |
| The container runtime | Container names, state, health and restarts |
| Journal and container logs | Only lines matching the configured levels |
| auth.log / journal | SSH and sudo outcomes — who, from where, and whether it worked |
What it deliberately does not
Secrets
Image scanning records where a secret was found — the file and the line — and never the value.
Anything it was not asked for
Log collection is per container and per level. A container you did not configure is not read.
Outgoing ports, by default
Their numbers change at every restart, so watching them is off until you turn it on for a host.
Read the install docs
The verification chain is worth a look before you run anything as root.
Start freeRead the install docs