pico_exporter

Minimal footprint OTLP system metrics exporter in C

pico_exporter is a system metrics exporter written in C that runs in about 120 kiB of memory. It is a drop-in replacement for the Prometheus node_exporter, but instead of waiting to be scraped it pushes the metrics to an OTLP gateway over TLS, so there is no need for an extra piece of software to pick the metrics up and forward them to the gateway.

I wanted system metrics from a Raspberry Pi, and every alternative I came across seemed to use an absurd amount of resources for the work it had to do. So I built my own. What I did not expect was to win three orders of magnitude of memory doing it. For the full story, see JOURNEY.md.

✨ Features

• Push-only: pushes to an HTTPS endpoint, uncompressed.
• TLS via BearSSL: one cipher suite, one curve, trust anchor compiled in.
• No malloc on the hot cycle path.
• Static binaries, no shared libraries: both x86_64 and aarch64 targets are production-ready.

⚖️ Comparison

Compared with the usual alternatives, Grafana Alloy and the Prometheus node_exporter:

Features

Resources

Only Grafana Alloy is compared here, because it is the one that does everything and can be measured head-to-head with pico_exporter. Measured on my machine, over the same running window:

👨‍💻 Getting started

1. Download the binary for your architecture from the latest release:

curl -fsSL -o pico_exporter \
  https://github.com/dpaneda/pico_exporter/releases/latest/download/pico_exporter-aarch64
chmod +x pico_exporter

2. Point it at a gateway and run:

GW_URL=https://otlp-gateway-prod/otlp/v1/metrics \
GW_USER=12345 GW_PASS=glc_... \
./pico_exporter

For building from source and the host prerequisites, see DEVELOPMENT.md.

⚙️ Configuration

Configuration is environment-based:

📦 Deploy

Drop the binary on the host, point it at your gateway and run it under whatever supervises your services. There is a ready unit in contrib/pico_exporter.service.

Every push writes a line to the log, so the journal is the whole health check: if it is working, you will see it say so each cycle.

The trust anchor is compiled in

There is no CA bundle on disk to point at: the root certificate is baked into the binary, and the default is DigiCert G2, the CA behind Grafana Cloud's gateway. Any endpoint signed by something else fails validation, and the fix is a rebuild rather than a flag. Point the build at the endpoint and it captures and compiles in the chain that endpoint serves:

make GW_URL=https://your-gateway:443/

INSECURE=1 skips validation altogether. It is not recommended: the binary then trusts any well-formed certificate, so anyone on the path can read and rewrite what you push.