Seems we have some language features not fully documented (like bitshift operators in #1322).

Would be good to go through language grammar and make sure everything is in the reference guide.

We have a TODO in the kprobe code:

https://github.com/cilium/ebpf/blob/2ef3f386b3d550ba605dee0f783a625f1f14c029/link/kprobe.go#L120

Doesn't sound too complicated, maybe this is a good first issue @ti-mo ?

We use kind for integration tests against a kubernetes cluster. We now have a dirty hack to load the built images into the kind docker daemon since when we started using it kind was at a very early stage and didn't have the load command. Now the load command is available so we can just replace the hack with it!

Docs here
https://kind.sigs.k8s.io/docs/user/quick-start/#loading-an-image-into-y

What I wanted to do
Print events as JSON output to a file.

What I observed

sudo ./dist/tracee-ebpf -o json -o out.json
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x30 pc=0x5a17a4]

goroutine 1 [running]:
github.com/aquasecurity/tracee/tracee-ebpf/tracee.newEventPrinter(0xc0000acc50, 0x8, 0xc00

Since the kernel's libbpf seems to handle .text ELF sections gracefully, we should probably do that too.

Can we get some performance comparison between polycube and using standard linux facilities (NAT, iptables, etc.)?

CPU usage, PPS, latencies, etc.