ServiceRadar: Why Security Teams Are Ditching Nagios for WASM Plugins

Your network monitoring agent has root access to every server it touches. Let that sink in. Every Nagios plugin, every Zabbix script, every SolarWinds probe runs with the full privileges of the host operating system. One compromised plugin, one malicious dependency update, and your entire infrastructure becomes an attacker's playground. This isn't theoretical—supply chain attacks on monitoring tools have exploded 742% since 2020, and traditional network management systems remain the soft underbelly that CISOs quietly lose sleep over.

But what if your monitoring plugins couldn't access the filesystem? What if they couldn't open raw sockets, couldn't execute shell commands, couldn't even see the network without explicit, audited permission? What if isolation wasn't a bolt-on afterthought but the foundational architecture?

Enter ServiceRadar—the zero-trust, open-source network management and observability platform that's rewriting the rules of infrastructure monitoring. Built by Carver Auto and now recognized in the CNCF Landscape, ServiceRadar replaces the antiquated "script-and-shell" plugin model with a hardware-sandboxed WebAssembly runtime that makes traditional NMS tools look like security liabilities with dashboards attached.

This isn't incremental improvement. This is a generational leap. And by the end of this article, you'll understand why security-conscious teams are migrating entire monitoring estates to ServiceRadar—and exactly how to join them.

What is ServiceRadar?

ServiceRadar is a distributed network monitoring system architected for modern infrastructure challenges: edge deployments, constrained environments, intermittent connectivity, and the non-negotiable requirement of zero-trust security. Born from the operational realities of monitoring infrastructure in "hard-to-reach places"—think remote cell towers, maritime vessels, industrial IoT deployments, and air-gapped facilities—ServiceRadar transcends its origins to deliver enterprise-grade observability for any organization serious about security posture.

The project, actively developed at code.carverauto.dev/carverauto/serviceradar, represents a fundamental reimagining of how monitoring systems should be constructed. Rather than bolting security onto a 1990s-era architecture, ServiceRadar's creators asked: What if we built network monitoring the way we'd build a cryptocurrency wallet or a confidential computing enclave?

The answer is a multi-component distributed system with mTLS everywhere, RBAC with SSO integration, and—most critically—a WASM plugin system that executes custom monitoring logic in a hardware-level sandbox with zero local dependencies. Plugins are "FS-less" by default: no filesystem access, no raw sockets, no ambient authority. Every network call is proxied through the Agent based on admin-approved allowlists, and every call is logged for audit.

ServiceRadar's recognition in the CNCF Landscape validates its architectural decisions, placing it alongside established cloud-native observability tools. But unlike many landscape entries, ServiceRadar isn't playing catch-up with legacy vendors—it's lapping them on security architecture while matching or exceeding their feature depth.

The platform's dual-SDK approach—Go and Rust—reflects modern systems programming sensibilities. The Go SDK serves operational teams seeking rapid plugin development, while the Rust SDK targets performance-critical extensions and security-sensitive environments where memory safety is paramount.

Key Features That Redefine Network Monitoring

Hardware-Sandboxed WASM Plugin System

ServiceRadar's signature innovation replaces traditional plugin architectures with a Wazero-powered WebAssembly runtime. This delivers capabilities that seem almost fantastical compared to legacy NMS tools:

• True process isolation: WASM modules execute in a sandbox with hardware-enforced boundaries, not the porous OS-process isolation of Nagios or Zabbix
• Zero dependency footprint: Plugins compile to static binaries requiring no runtime installation on monitored hosts
• Capability-based security: Network access is explicitly granted via proxy, not inherited from host privileges
• Cross-platform portability: Write once, run on any architecture that supports WASM—no more platform-specific script maintenance

GPU-Native Topology Engine

ServiceRadar renders millions of interactive network nodes and edges at 60fps through a topology stack built on deck.gl, Apache Arrow for zero-copy streaming, and WASM-native logic. This isn't a static diagram refreshed every five minutes—it's a living, breathing map of your infrastructure that responds to queries in real-time.

Causal Engine with DeepCausality

When incidents strike, mean time to resolution depends on finding root cause fast. ServiceRadar integrates DeepCausality—a Rust-based causal inference engine—using hybrid filtering and roaring bitmaps to isolate event "blast radius" in microseconds. The system doesn't just alert; it explains.

Custom React^{↗ Bright Coding Blog} Dashboards with SRQL

The Dashboard SDK enables customer-authored React dashboards that run inside ServiceRadar's web UI. Dashboards receive SRQL-backed data frames and support local development with hot module reloading. The query language itself—SRQL—uses intuitive key:value syntax for time-series and relational data, flattening the learning curve for operators coming from SQL or PromQL.

Unified Data Layer

ServiceRadar consolidates relational, time-series, and graph topology data in a single queryable layer powered by CloudNativePG, TimescaleDB, PGVector, and Apache AGE. No more context-switching between Prometheus, Grafana, and a separate CMDB—everything lives in PostgreSQL^{↗ Bright Coding Blog}-compatible storage with appropriate extensions.

Comprehensive Observability Integrations

Native support spans OTEL, GELF, Syslog, SNMP (polling/traps), BGP via BMP, and NetFlow. The Graph Network Mapper discovers interfaces and topology relationships via SNMP/LLDP/CDP. For automation teams, Ansible playbooks execute through AWX/AAP with live per-host telemetry projected to OCSF format.

Use Cases: Where ServiceRadar Dominates

1. Edge and Constrained Environment Monitoring

Remote oil rigs, military forward operating bases, and satellite ground stations share common constraints: intermittent connectivity, limited compute, and zero tolerance for security exposure. ServiceRadar's Agent-Gateway-Core architecture allows edge agents to buffer metrics locally, stream via gRPC when connectivity permits, and execute WASM plugins without expanding the attack surface. The hardware sandbox means a compromised edge device can't pivot through the monitoring system.

2. Multi-Tenant Cloud Infrastructure

Managed service providers monitoring customer infrastructure face a brutal truth: traditional plugins running as root violate every tenant isolation boundary. ServiceRadar's capability-based network proxy ensures plugins can only reach explicitly allowlisted endpoints. Combined with mTLS and RBAC, this enables true zero-trust monitoring where even a fully compromised plugin can't escape its sandbox.

3. Critical Infrastructure and OT Networks

Operational technology environments—power grids, water treatment, manufacturing lines—increasingly require monitoring but categorically reject software with root access. ServiceRadar's FS-less plugins, signed container images with Cosign verification, and hardware isolation satisfy security frameworks that would reject Nagios, Zabbix, or SolarWinds outright.

4. Supply Chain Security Hardening

The 2020 SolarWinds breach demonstrated that monitoring tools themselves become supply chain attack vectors. ServiceRadar counters this with Cosign-signed images, reproducible WASM builds, and a plugin system where malicious code simply cannot access the host. The verification workflow using docs/cosign.pub provides cryptographic proof of image provenance.

Step-by-Step Installation & Setup Guide

Docker^{↗ Bright Coding Blog} Compose (Under 5 Minutes)

ServiceRadar's fastest path to production uses Docker Compose with pre-built images:

# Configure environment variables
export SERVICERADAR_HOST=<my-vm-ip>
export GATEWAY_PUBLIC_BIND=0.0.0.0

# Clone the repository
git clone https://code.carverauto.dev/carverauto/serviceradar.git
cd serviceradar

# Pull and initialize infrastructure
docker compose pull
docker compose up nats-creds-init
docker compose up -d

# Retrieve admin credentials
docker compose logs config-updater

Access the UI at http://localhost with login root@localhost and the password from config-updater logs.

For pinned releases, set APP_TAG=v1.2.32 in .env. For development with hot-reload overlays, add COMPOSE_FILE=docker-compose.yml:docker-compose.dev.yml.

Kubernetes / Helm Deployment

Production Kubernetes deployments use ServiceRadar's OCI-published Helm chart:

# Inspect chart metadata and defaults
helm show chart oci://registry.carverauto.dev/serviceradar/charts/serviceradar --version 1.2.32
helm show values oci://registry.carverauto.dev/serviceradar/charts/serviceradar --version 1.2.32 > values.yaml

# Install pinned release (recommended for production)
helm upgrade --install serviceradar oci://registry.carverauto.dev/serviceradar/charts/serviceradar \
  --version 1.2.32 \
  -n serviceradar --create-namespace \
  --set global.imageTag="v1.2.32"

# For staging/dev with latest images
helm upgrade --install serviceradar oci://registry.carverauto.dev/serviceradar/charts/serviceradar \
  --version 1.2.32 \
  -n serviceradar --create-namespace \
  --set global.imageTag="latest" \
  --set global.imagePullPolicy="Always"

# Extract admin password
kubectl get secret serviceradar-secrets -n serviceradar \
    -o jsonpath='{.data.admin-password}' | base64 -d

Critical note: Chart versions follow 1.2.32 format while image tags use v1.2.32. For registry authentication, set image.registryPullSecret (defaults to registry-carverauto-dev-cred).

ArgoCD GitOps Deployment

For GitOps workflows, reference the chart repository without the oci:// prefix:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: serviceradar
  namespace: argocd
spec:
  destination:
    server: https://kubernetes.default.svc
    namespace: serviceradar
  source:
    repoURL: registry.carverauto.dev/serviceradar/charts
    chart: serviceradar
    targetRevision: "1.2.32"
    helm:
      values: |
        global:
          imageTag: "v1.2.32"

REAL Code Examples from the Repository

Example 1: Dashboard SDK Scaffolding

ServiceRadar's Dashboard SDK enables local React development with hot module reloading. This workflow demonstrates the complete authoring pipeline:

# Scaffold a new map-based dashboard
npm create @carverauto/create-dashboard@latest my-dashboard -- --template react-map
cd my-dashboard

# Install dependencies with lockfile
npm ci

# Start local development server with HMR
npm run dev

# Validate package before production submission
npm run validate

# Publish signed dashboard to ServiceRadar instance
npx serviceradar-cli dashboard publish

What's happening here? The @carverauto/create-dashboard generator bootstraps a Vite-based React project preconfigured with ServiceRadar's browser module API. The react-map template includes Mapbox/deck.gl integration, SRQL query hooks, and Arrow-backed data frame handling. npm run dev launches a local harness that simulates the ServiceRadar runtime environment, enabling rapid iteration without deploying to production. The validate command checks package signatures, dependency vulnerabilities, and API compatibility. Finally, serviceradar-cli dashboard publish creates a cryptographically signed package for secure distribution.

Example 2: Cosign Image Verification

ServiceRadar publishes signed container images to Harbor. Verify image integrity before deployment:

# Verify a tagged release with the published public key
cosign verify \
  --experimental-oci11 \
  --key docs/cosign.pub \
  registry.carverauto.dev/serviceradar/serviceradar-core-elx:v1.2.32

# Prefer immutable commit-sha tags for build-specific verification
cosign verify \
  --experimental-oci11 \
  --key docs/cosign.pub \
  registry.carverauto.dev/serviceradar/serviceradar-core-elx:sha-ac23dc0ebcbee0d6a964dc8307826bf2a063536c

Security deep-dive: The --experimental-oci11 flag enables OCI v1.1 reference types for attaching signatures to images without mutating tags. Using docs/cosign.pub—committed in the repository—provides out-of-band key distribution separate from the container registry. The sha- prefixed tags bind to specific Git commits, enabling reproducible verification even if tag v1.2.32 were force-moved. This dual-tagging strategy (semantic + immutable) balances human readability with supply chain security.

Example 3: Self-Hosted Keyless Verification

For organizations running private Sigstore infrastructure, ServiceRadar supports keyless verification against custom trusted roots:

cosign verify \
  --experimental-oci11 \
  --trusted-root docs/sigstore/trusted-root.json \
  --certificate-identity-regexp '<issuer-specific SAN regex>' \
  --certificate-oidc-issuer https://issuer.example.com \
  registry.carverauto.dev/serviceradar/serviceradar-core-elx:sha-ac23dc0ebcbee0d6a964dc8307826bf2a063536c

Enterprise context: Keyless verification eliminates private key management entirely, replacing it with short-lived certificates bound to OIDC identity. The --trusted-root parameter anchors trust in your organization's Sigstore instance rather than the public good. --certificate-identity-regexp enables policy-based verification—e.g., only accepting images signed by CI pipelines running in specific GitHub repositories. This pattern scales to thousands of developers without key rotation ceremonies or HSM provisioning.

Advanced Usage & Best Practices

Plugin Development Security Hardening

When authoring WASM plugins, never request broader network permissions than your check requires. The Network Bridge's allowlist mechanism is your security perimeter—treat it like a firewall rule. Structure plugins as pure functions: input is configuration + proxied network access, output is structured metrics. Avoid embedding secrets; instead, use ServiceRadar's secret injection for API keys or SNMP community strings.

Topology Performance Optimization

For million-node topologies, pre-aggregate metrics at the Agent before streaming to Core. Use Apache Arrow's zero-copy semantics in custom dashboards to minimize JavaScript^{↗ Bright Coding Blog} garbage collection pauses. Enable GPU acceleration in deck.gl layers for edge-heavy visualizations.

Database Tuning

TimescaleDB hypertables should be partitioned by time and device ID for parallel query execution. PGVector enables topology similarity search for anomaly detection. Apache AGE graph queries power the blast-radius analysis in the Causal Engine—index relationship edges on (source_type, target_type, relationship).

Monitoring the Monitors

Deploy a secondary ServiceRadar instance or use the built-in health endpoints to observe your primary monitoring infrastructure. The NATS JetStream monitoring API exposes stream lag and consumer group health—critical for detecting agent connectivity degradation before data loss occurs.

Comparison with Alternatives

The verdict: Prometheus/Grafana excels at cloud-native metrics but lacks ServiceRadar's security architecture and causal engine. Nagios and Zabbix carry decades of technical debt that make zero-trust retrofitting impractical. SolarWinds' proprietary model and security history speak for themselves. ServiceRadar occupies a unique position: open-source with enterprise-grade isolation, modern observability, and extensibility that doesn't compromise security.

FAQ

Q: Can ServiceRadar replace my existing Nagios/Zabbix deployment entirely?

A: For most use cases, yes. ServiceRadar's SNMP, ICMP, and custom check coverage matches legacy NMS capabilities. Migration involves translating Nagios check commands to WASM plugins—a one-time effort with permanent security dividends. The Ansible integration even enables gradual migration by orchestrating legacy tools during transition.

Q: How does WASM plugin performance compare to native binaries?

A: The Wazero runtime achieves near-native performance for I/O-bound monitoring checks. CPU-intensive analytics should leverage the Causal Engine or run in Core's Elixir/BEAM runtime. The security-performance tradeoff overwhelmingly favors WASM for typical network monitoring workloads.

Q: Is ServiceRadar production-ready?

A: With CNCF Landscape recognition, OpenSSF best practices compliance, FOSSA security scanning, and signed releases, ServiceRadar meets enterprise production standards. The active development at code.carverauto.dev demonstrates committed maintenance.

Q: What skills do I need to write custom plugins?

A: Go or Rust fundamentals suffice. The SDKs abstract WASM boilerplate, exposing familiar HTTP client patterns. No WebAssembly expertise required—compile with tinygo or wasm32-unknown-unknown target and the SDK handles runtime integration.

Q: How does SRQL compare to PromQL or SQL?

A: SRQL's key:value syntax reduces query complexity for common monitoring patterns. metric:cpu_usage host:web-* time:last_hour expresses intent without JOIN syntax. For complex analytics, the unified data layer supports standard SQL through PostgreSQL compatibility.

Q: Can I run ServiceRadar air-gapped?

A: Absolutely. The Docker Compose and Helm deployments function without internet connectivity after initial image pull. The WASM plugin system eliminates external dependency resolution. For fully offline environments, mirror the Harbor registry and Sigstore trust material internally.

Q: What's the resource overhead of the WASM runtime?

A: The Wazero runtime adds approximately 2-5MB memory per plugin instance with sub-millisecond startup. Agents coalesce multiple plugins efficiently. Typical deployments show <100MB agent memory usage with 20+ active checks.

Conclusion

ServiceRadar isn't merely another entry in the crowded network monitoring space—it's a fundamental architectural reset. By replacing the decades-old "root access for everyone" plugin model with hardware-sandboxed WebAssembly, by rendering millions of topology nodes at GPU-native speeds, by integrating causal inference that explains rather than merely alerts, ServiceRadar delivers what legacy vendors have promised but cannot architecturally achieve: genuine zero-trust observability.

The migration path is pragmatic. Docker Compose gets you running in five minutes. Helm charts enable production Kubernetes deployment with signed, verifiable images. The Go and Rust SDKs flatten the plugin learning curve. And the React Dashboard SDK empowers teams to build exactly the visibility they need—without vendor lock-in or security compromise.

Your monitoring infrastructure has been your biggest blind spot. Every traditional NMS plugin running as root, every opaque binary from a proprietary vendor, every un-audited network call has been a vulnerability waiting for exploitation. ServiceRadar closes these gaps not with patches, but with architecture.

The code is open. The security model is published. The CNCF has recognized its cloud-native validity. What remains is your decision to stop accepting "that's how monitoring has always worked" as an answer.

Get started today: Clone the repository at github.com/carverauto/serviceradar, explore the live demo at demo.serviceradar.cloud (login: demo@localhost, password: serviceradar), and join the community on Discord. Your infrastructure deserves monitoring that secures rather than exposes. ServiceRadar is that monitoring—finally built for the threats of 2025 and beyond.

Found this analysis valuable? Star the repository, share with your platform engineering team, and watch for deep-dive guides on WASM plugin development and SRQL query optimization coming next.