Install groot
Recommended: run the installer script, then verify with groot -v (currently v1.0.4).
Unix (macOS, Linux, WSL)
curl -fsSL https://get.groot.hermesrodriguez.com/install.sh | sh
Inspect before running: curl -fsSL … -o install.sh && less install.sh
Other installation methods
| Homebrew | brew install --cask hrodrig/groot/groot |
| Go install | go install github.com/hrodrig/groot/cmd/groot@latest |
| Docker | docker pull ghcr.io/hrodrig/groot:1.0.4 |
| GitHub Releases | .deb, .rpm, .tar.gz |
| kubectl plugin | kubectl groot validate --config groot.yml |
Incident workflow (1.0)
Set config_version: 1 in new configs; validate before the first scheduled run; use --summary on collect; inspect archives offline. See SPECIFICATIONS.md.
$ groot validate --config groot.yml $ groot collect --config groot.yml --summary $ groot inspect ./groot-*.tar.gz
Homebrew 6+ (tap trust)
Homebrew 6 requires trust for third-party taps. brew install --cask hrodrig/groot/groot (fully qualified) trusts only this cask. Warnings like “Skipping … because it is not trusted” for other taps during auto-update are unrelated and do not block groot.
Quieter one-shot: HOMEBREW_NO_AUTO_UPDATE=1 brew install --cask hrodrig/groot/groot. Do not set HOMEBREW_NO_REQUIRE_TAP_TRUST=1 (not recommended; will be removed). See docs.brew.sh/Tap-Trust.
macOS first run (Gatekeeper)
Unsigned CLI binaries may show “Apple could not verify…” on the first groot or kubectl groot run. This is download quarantine, not malware. Clear it once for each binary you use:
xattr -dr com.apple.quarantine "$(command -v groot)"
xattr -dr com.apple.quarantine "$(command -v kubectl-groot)"
Or use System Settings → Privacy & Security → Open Anyway. Updated Homebrew casks clear quarantine on install.
Getting started
$ groot --print-sample-config > groot.yml # adjust $ groot validate --config groot.yml $ groot collect --config groot.yml --summary $ groot inspect ./groot-*.tar.gz
Point groot at your kubeconfig, run groot collect, and attach the tarball. See SPECIFICATIONS.md.