iop

A modern iotop in Rust. eBPF-powered. No Python. No root required (CAP_BPF only).

🚧 Phase 3 deliverable — slated for ~M8-M10. See ROADMAP.md and DESIGN.md.

✨ Why（draft）

• eBPF on block layer — sees IO inside containers, no missed events.
• CAP_BPF, not root — safer to deploy.
• Single static binary — no Python runtime, no LLVM toolchain on target.
• Kubernetes-aware — auto-groups IO by Pod / container from cgroup v2.
• JSON / NDJSON output — pipe to Prometheus, time-series databases.
• ~10ms startup — vs iotop (Python)'s ~200ms.

📦 Install

# (Coming with 0.1.0 release)
cargo install iop

⚡ Quickstart（planned）

sudo setcap cap_bpf=ep $(which iop)      # one-time setup, no more sudo
iop                                       # interactive TUI
iop --group-by pod                        # per-Pod aggregation
iop --duration 60 -o ndjson > io.log      # 60s batch capture
iop --sort latency                        # spot slow-IO processes

🆚 vs iotop

	iotop (Python)	iop (Rust)
Language	Python	Rust
Backend	taskstats (netlink)	eBPF tracepoints
Privilege	root	CAP_BPF
Startup time	~200ms	~10ms
Container-aware	❌	✅ (cgroup v2)
JSON output	❌	✅
Sortable columns	limited	full
K8s pod grouping	❌	✅

🔗 Related tools

• td — modern tcpdump.
• ngr — network grep with HTTPS support.

License

MIT OR Apache-2.0.

Acknowledgements

• Guillaume Chazarain — original Python iotop author.
• iotop-c — for proving the C rewrite was worth doing; we go one step further with eBPF.
• The Linux block tracepoint maintainers.