Seems we have some language features not fully documented (like bitshift operators in #1322).

Would be good to go through language grammar and make sure everything is in the reference guide.

We use kind for integration tests against a kubernetes cluster. We now have a dirty hack to load the built images into the kind docker daemon since when we started using it kind was at a very early stage and didn't have the load command. Now the load command is available so we can just replace the hack with it!

Docs here
https://kind.sigs.k8s.io/docs/user/quick-start/#loading-an-image-into-y

What I wanted to do
Print events as JSON output to a file.

What I observed

sudo ./dist/tracee-ebpf -o json -o out.json
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x30 pc=0x5a17a4]

goroutine 1 [running]:
github.com/aquasecurity/tracee/tracee-ebpf/tracee.newEventPrinter(0xc0000acc50, 0x8, 0xc00

Updating the demo gifs is a bit complicated as we use https://github.com/kinvolk/gifterminal/tree/kai/fonts-and-paths and it's not clear what are the dependencies needed to use it. It'll be nice to have a container image with everything is needed inside.

Can we get some performance comparison between polycube and using standard linux facilities (NAT, iptables, etc.)?

CPU usage, PPS, latencies, etc.

When the k8s subcommand notices that a container is deleted, it keeps the tracelet for one minute. Directly retire the tracelet without any timeouts after dumping it a final time and store the rendered string compressed in a second list (which has a maximal length, appending if full will push the oldest element out).
If the API functions for dump, close etc can't find an active tracelet,