Instana host agent as a non-root user on Linux is now in Public Preview
Running observability agents with elevated privileges has long been a concern for security-conscious teams. For organizations that follow least-privilege principles, root access can create friction between security policy and operational visibility.
To help address that gap, IBM Instana Observability now supports running the host agent as a non-root user on Linux in Public Preview.
This new capability is designed for teams that want to maintain broad observability coverage while strengthening their security posture.
Why it matters
In many enterprise environments, security requirements limit where and how software can run with privileged access. Monitoring agents have traditionally needed root access to collect host-level data, which can be a blocker for adoption in tightly controlled environments.
With the non-root agent, Instana takes a more security-aligned approach. The agent can run under a dedicated non-root user while still supporting the monitoring capabilities teams rely on for day-to-day operations.
For platform engineers, security architects, and operations teams, this means observability can fit more naturally into hardened Linux environments.
How it works
The non-root host agent uses Linux kernel capabilities to grant only the privileges required for monitoring tasks, instead of relying on full root access at runtime.
This approach delivers an important outcome: feature parity with root-based installations on supported Linux systems.
That means teams do not need to choose between visibility and security. They can adopt a non-root deployment model without accepting reduced monitoring coverage.
Key benefits
Stronger security posture
Running the agent as a non-root user reduces unnecessary privilege at runtime and supports least-privilege operating models. This can help organizations align observability deployments with internal security standards and compliance expectations.
Full monitoring coverage
This capability is designed to support the same sensors and monitoring features available in standard root-based installations on supported Linux hosts.
Operational consistency
The non-root agent integrates with systemd, so deployment and service lifecycle management remain familiar for Linux administrators.
Straightforward installation
Enabling the feature is simple. During installation, set: INSTANA_AGENT_NON_ROOT=true.
The installer then handles the required setup, including user and group creation, capability assignment, and service configuration.
Requirements and current limitations
As of this Public Preview, keep the following in mind:
Requirements
- systemd-based Linux distribution
- Linux kernel 4.3 or later
- root or sudo access for the initial installation only
Current limitations
- Linux hosts only
- Kubernetes deployments are not yet supported
- Red Hat OpenShift deployments are not yet supported
- External Java runtimes are not supported; the agent uses its bundled Java runtime
Additional note
- For IBM MQ monitoring, use a user and group name with 12 characters or fewer
Getting started
To deploy the non-root agent, set the INSTANA_AGENT_NON_ROOT=true environment variable during installation.
The installer will:
- create the system user and group
- apply the required Linux capabilities
- configure the systemd service
- set the necessary permissions
For setup details, see the product documentation: Running the agent as a non-root user on Linux (Public Preview)
Why we’re sharing this in TechXchange
This Public Preview is especially relevant for teams operating in environments where privileged access is tightly controlled. We know many of you have been looking for ways to extend observability without compromising security requirements, and this is an important step in that direction.
If you test this capability, we’d be interested in hearing:
- how it fits into your Linux hardening standards
- whether it simplifies agent rollout in regulated environments
- what additional platform support you would like to see next
Join the discussion
Have you tried the non-root host agent in your environment? What worked well, and what would you like to see improved before general availability?
Share your feedback and questions here in the Instana TechXchange community so the product and engineering teams can learn from your experience.
You can also explore: