Coroot: Open-source observability and APM with AI-powered RCA

Coroot is an open-source observability and application performance monitoring (APM) platform that uses artificial intelligence to automatically identify root causes of system issues. Unlike traditional monitoring tools that just collect data, Coroot transforms raw telemetry into actionable insights, synthesizing metrics, logs, traces, and profiles to provide contextual intelligence about your system's health.

Key differentiators:

• Zero instrumentation: Uses eBPF to gather observability data without code changes
• AI-powered RCA: Automatically diagnoses problems like an experienced SRE
• 80% faster MTTR: Significantly reduces mean time to resolution
• Cost-effective alternative to Datadog, New Relic, and other commercial APM tools
• Full visibility in under 30 minutes with minimal setup

With 7,600+ GitHub stars, Coroot is built on open standards (OpenTelemetry, ClickHouse) and offers both self-hosted and cloud deployment options.

Coroot is built on a modern, high-performance architecture designed for distributed systems observability:

Backend:

• Go (60.3% of codebase) - Core platform and data processing
• eBPF (extended Berkeley Packet Filter) - Zero-instrumentation data collection at the kernel level
• ClickHouse - Time-series data storage with lightning-fast search
• OpenTelemetry - Vendor-neutral distributed tracing standard
• gRPC - Inter-service communication protocol
• Prometheus - Metrics collection and storage (with Remote Write support)

Frontend:

• Vue.js (37.6% of codebase) - Interactive web interface
• JavaScript - Supporting UI components

Core Components:

• coroot - Main platform with API, collector, and web interface
• coroot-node-agent - Deployed on each monitored node for eBPF data collection
• ClickHouse - Required for storing and querying telemetry data
• Prometheus - Required for metrics ingestion with Remote Write enabled

Deployment Options:

• Kubernetes (via Helm charts)
• Docker / Docker Compose
• Docker Swarm
• Native installation (Ubuntu, Debian, RHEL, CentOS)

License: Apache 2.0

Backend:
├── Go (core platform)
├── eBPF (data collection)
├── ClickHouse (storage)
├── OpenTelemetry (tracing)
├── gRPC (communication)
└── Prometheus (metrics)

Frontend:
├── Vue.js
└── JavaScript

Components:
├── coroot (main platform)
├── coroot-node-agent
├── ClickHouse server
└── Prometheus server

Before installing Coroot, ensure you have the following infrastructure in place:

Required Services:

• Prometheus server with Remote Write Receiver enabled - Coroot uses this to ingest metrics
• ClickHouse server - For time-series data storage and fast querying

For Docker installations:

• Docker Engine 20.10+ and Docker Compose v2+
• Sufficient system resources (2+ CPU cores, 4GB+ RAM recommended)

For Kubernetes installations:

• Kubernetes cluster 1.20+ (managed or self-hosted)
• Helm 3.0+ installed locally
• kubectl configured to access your cluster

For native Linux installations:

• Ubuntu 20.04+ / Debian 11+ or RHEL 8+ / CentOS 8+
• Root or sudo access

System Permissions:

• The coroot-node-agent requires elevated privileges to use eBPF
• Container deployments need --privileged mode or specific capabilities

# Verify Docker and Compose versions
docker --version
docker compose version

# Verify Kubernetes access
kubectl version --client
helm version

# Check available system resources
free -h
nproc

The fastest way to get Coroot running is with Docker Compose. This automatically deploys Coroot with all required dependencies (Prometheus and ClickHouse) in a single command.

The automated installation script fetches the latest docker-compose configuration and starts all services. Coroot will be accessible at http://localhost:8080/ after the containers are running.

# One-command installation (downloads and starts all services)
curl -fsS https://coroot.com/install-coroot-ce | bash

# Access Coroot web interface
open http://localhost:8080/

# View running containers
docker compose ps

# View logs
docker compose logs -f coroot

# Stop all services
docker compose down

# Stop and remove all data
docker compose down -v

For production Kubernetes environments, deploy Coroot using the official Helm chart. This approach uses the Coroot Operator to manage the installation and provides better scalability and integration with Kubernetes workloads.

The Coroot Operator handles deployment orchestration, while the Community Edition chart installs the core platform with ClickHouse. Once deployed, use port-forwarding to access the web interface, or configure an Ingress for production access.

# Add Coroot Helm repository
helm repo add coroot https://coroot.com/charts
helm repo update

# Install the Coroot Operator
helm install --create-namespace coroot-operator coroot/coroot-operator \
  --namespace coroot

# Install Coroot Community Edition with ClickHouse
helm install coroot coroot/coroot-ce \
  --namespace coroot \
  --set clickhouse.enabled=true

# Check deployment status
kubectl get pods -n coroot
kubectl get svc -n coroot

# Forward port to access web interface
kubectl port-forward -n coroot svc/coroot 8080:8080

# Access at http://localhost:8080/

# View logs
kubectl logs -n coroot -l app=coroot -f

Configure Coroot using environment variables for custom deployments. These settings control data ingestion, refresh intervals, and integration with Prometheus and ClickHouse.

Key Configuration Variables:

• BOOTSTRAP_PROMETHEUS_URL - URL of your Prometheus server with Remote Write enabled
• BOOTSTRAP_REFRESH_INTERVAL - How often to refresh data from Prometheus (e.g., 15s, 30s, 1m)
• BOOTSTRAP_CLICKHOUSE_ADDRESS - ClickHouse server address for data storage
• COLLECTOR_ENDPOINT - Endpoint where coroot-node-agents send data

For Docker deployments, set these in a .env file or docker-compose.yml. For Kubernetes deployments, pass them as Helm values or ConfigMap entries. For native installations, export them before running the installation script.

# Example environment configuration
export BOOTSTRAP_PROMETHEUS_URL=http://prometheus:9090
export BOOTSTRAP_REFRESH_INTERVAL=15s
export BOOTSTRAP_CLICKHOUSE_ADDRESS=clickhouse:9000
export COLLECTOR_ENDPOINT=http://coroot:8080

# For Docker Compose, create .env file:
cat > .env << EOF
BOOTSTRAP_PROMETHEUS_URL=http://prometheus:9090
BOOTSTRAP_REFRESH_INTERVAL=15s
BOOTSTRAP_CLICKHOUSE_ADDRESS=clickhouse:9000
COLLECTOR_ENDPOINT=http://coroot:8080
EOF

# For Helm, pass as values:
helm install coroot coroot/coroot-ce \
  --namespace coroot \
  --set prometheus.url=http://prometheus:9090 \
  --set clickhouse.address=clickhouse:9000

The coroot-node-agent must be deployed on every node you want to monitor. It uses eBPF to collect metrics, logs, traces, and profiles without requiring application instrumentation.

Kubernetes (DaemonSet): The Helm chart automatically deploys node-agents as a DaemonSet, ensuring one agent per node. The agents run in privileged mode to access eBPF capabilities.

Docker Swarm: Deploy the node-agent on each swarm node with specific volume mounts for /sys, /proc, and Docker socket access.

Standalone Docker/VMs: Run the node-agent container with --privileged flag and mount host filesystems.

Native Linux: Install the node-agent package on each infrastructure node using the provided installation script.

The node-agent automatically discovers running applications and begins collecting telemetry data without any application code changes.

# Kubernetes - Verify node-agent DaemonSet
kubectl get daemonset -n coroot coroot-node-agent
kubectl get pods -n coroot -l app=coroot-node-agent

# Docker Swarm - Deploy node-agent on each node
docker service create \
  --name coroot-node-agent \
  --mode global \
  --network coroot \
  --mount type=bind,source=/sys,target=/host/sys,readonly \
  --mount type=bind,source=/proc,target=/host/proc,readonly \
  --mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock,readonly \
  --cap-add SYS_ADMIN \
  --cap-add SYS_PTRACE \
  --cap-add NET_ADMIN \
  --cap-add NET_RAW \
  --env COLLECTOR_ENDPOINT=http://coroot:8080 \
  ghcr.io/coroot/coroot-node-agent:latest

# Standalone Docker
docker run -d \
  --name coroot-node-agent \
  --privileged \
  --pid host \
  --network host \
  -v /sys:/host/sys:ro \
  -v /proc:/host/proc:ro \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -e COLLECTOR_ENDPOINT=http://localhost:8080 \
  ghcr.io/coroot/coroot-node-agent:latest

# Native Linux - Install on Ubuntu/Debian
curl -fsS https://coroot.com/install-node-agent | bash -s -- \
  --collector-endpoint http://coroot:8080

Coroot provides comprehensive observability capabilities that go beyond traditional monitoring:

Automatic Service Mapping: Visualizes your entire infrastructure and service dependencies automatically. Shows real-time topology with health indicators, making it easy to understand system architecture at a glance.

AI-Powered Root Cause Analysis: When issues occur, Coroot's AI engine traces dependencies, identifies the root cause, and suggests fixes — just like an experienced SRE. This dramatically reduces MTTR.

Distributed Tracing: Built-in OpenTelemetry support enables tracing requests across service boundaries. Identify slow requests, bottlenecks, and cascading failures without instrumentation.

Continuous Profiling: Analyze CPU and memory usage down to specific code lines. Profile applications in production without performance overhead.

SLO-Based Alerting: Define Service Level Objectives and get alerted when they're breached. Coroot automatically inspects issues and provides context.

Deployment Tracking: Monitor Kubernetes rollouts automatically. Compare performance between releases to catch regressions early.

Cost Monitoring: Attribute cloud expenses (AWS, GCP, Azure) to specific applications and services. Understand where your money is going.

Log Aggregation: Collects and correlates logs from all services without requiring log forwarders or agents.

Coroot Features:

✓ Zero-instrumentation data collection
✓ AI root cause analysis
✓ Service dependency mapping
✓ Distributed tracing (OpenTelemetry)
✓ Continuous profiling (CPU/Memory)
✓ SLO-based alerting
✓ Kubernetes deployment tracking
✓ Multi-cloud cost attribution
✓ Log aggregation and search
✓ Custom dashboards
✓ Prometheus integration
✓ Slack/PagerDuty/Webhook alerts

Coroot integrates with your existing observability infrastructure and cloud providers:

Metrics:

• Prometheus (required) - Primary metrics source via Remote Write
• Custom metrics endpoints

Tracing:

• OpenTelemetry - Native support for distributed traces
• Jaeger, Zipkin - Via OpenTelemetry compatibility

Logs:

• Automatic collection from containers and applications
• syslog, journald integration

Cloud Providers:

• AWS - Cost data, CloudWatch metrics
• Google Cloud Platform - Billing, monitoring
• Microsoft Azure - Cost management

Orchestrators:

• Kubernetes - First-class support with automatic discovery
• Docker Swarm - Native integration
• Docker standalone - Direct monitoring

Alerting:

• Slack - Notification channel
• PagerDuty - Incident management
• Webhooks - Custom integrations
• Email - Built-in notification

Databases:

• PostgreSQL, MySQL, MongoDB - Automatic discovery and monitoring
• Redis, Memcached - Cache layer observability

# Example Prometheus Remote Write configuration
# Add to prometheus.yml
remote_write:
  - url: http://coroot:8080/prometheus/write
    write_relabel_configs:
      - source_labels: [__name__]
        regex: 'up|.*_duration_.*|.*_size_.*|.*_count.*'
        action: keep

# Enable Remote Write Receiver
# Add to Prometheus command flags
--enable-feature=remote-write-receiver \
--web.enable-remote-write-receiver

For production environments, follow these recommendations:

High Availability:

• Run multiple Coroot replicas behind a load balancer
• Use external ClickHouse cluster with replication
• Deploy Prometheus with federation or remote write to multiple targets

Resource Planning:

• Allocate 2-4 CPU cores and 8-16GB RAM for the Coroot platform
• ClickHouse requires 4+ CPU cores and 16GB+ RAM for medium deployments
• Plan for ~10-50GB storage per monitored node per month (depends on cardinality)

Security:

• Enable authentication on the Coroot web interface
• Use TLS for all inter-component communication
• Restrict network access to Coroot components
• Run node-agents with minimal required privileges

Monitoring:

• Monitor Coroot itself with metrics exports
• Set up alerts for ClickHouse disk usage
• Track Prometheus remote write lag

Data Retention:

• Configure ClickHouse TTL policies based on your needs
• Default retention is typically 30-90 days
• Archive older data to object storage if needed

# Example Kubernetes resource limits
apiVersion: apps/v1
kind: Deployment
metadata:
  name: coroot
spec:
  replicas: 2  # HA setup
  template:
    spec:
      containers:
      - name: coroot
        resources:
          requests:
            cpu: 2000m
            memory: 8Gi
          limits:
            cpu: 4000m
            memory: 16Gi
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 30
        readinessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 10

Official Documentation: https://docs.coroot.com

GitHub Repository: https://github.com/coroot/coroot (Apache 2.0 license, 7,600+ stars)

Website: https://coroot.com

Community:

• Slack: Join via coroot.com
• GitHub Discussions: https://github.com/coroot/coroot/discussions
• Issues/Features: https://github.com/coroot/coroot/issues

Cloud Offering: Coroot also offers a managed cloud version at coroot.com/cloud for teams that prefer not to self-host.

Comparison with Alternatives: Coroot positions itself as a cost-effective, open-source alternative to:

• Datadog (commercial APM)
• New Relic (commercial APM)
• Dynatrace (commercial APM)
• Grafana + Loki + Tempo stack (requires more setup)

Getting Help:

• Check docs.coroot.com first
• Search GitHub issues for similar problems
• Join the Slack community for real-time help
• Open GitHub issues for bugs or feature requests

Documentation: https://docs.coroot.com
GitHub: https://github.com/coroot/coroot
Website: https://coroot.com
Slack: coroot.com (join link)
Discussions: github.com/coroot/coroot/discussions

Cloud Version: coroot.com/cloud

License: Apache 2.0
Stars: 7,600+
Language: Go 60%, Vue.js 38%