bpf

Is your feature request related to a problem? Please describe.

Useful for networking tracing to convert from network order to host order.

Describe the solution you'd like

int[8|16|32|64] bswap(int[8|16|32|64])

We can make bswap() infer the integer width and return the appropriate integer. Previous discussi

We use kind for integration tests against a kubernetes cluster. We now have a dirty hack to load the built images into the kind docker daemon since when we started using it kind was at a very early stage and didn't have the load command. Now the load command is available so we can just replace the hack with it!

Docs here
https://kind.sigs.k8s.io/docs/user/quick-start/#loading-an-image-into-y

We currently only check for CAP_SYS_ADMIN when running Tracee (https://github.com/aquasecurity/tracee/blob/main/tracee-ebpf/main.go#L885), which was correct for old kernels.
For newer kernels, CAP_SYS_ADMIN was split into combination of 3 other capabilities:
CAP_BPF, CAP_PERFMON and CAP_NET_ADMIN as described in https://lwn.net/Articles/820560/, and https://lwn.net/Articles/822362/
Update check

kinvolk/inspektor-gadget#163 introduced support for a new hook mode based on NRI (Node Resource Interface). Currently this mode only works if the user explicitly pass the --hook-mode=nri option and it's not considered when --hook-mode=auto is used.

Inspektor Gadget should detect if containerd v1.5+ is used as runtime and set HOOK_MODE="podinformer" in the followin

Add _split variant of btf__get_from_id() API. The name should take into account libbpf/libbpf#278, though.

Can we get some performance comparison between polycube and using standard linux facilities (NAT, iptables, etc.)?

CPU usage, PPS, latencies, etc.

When the k8s subcommand notices that a container is deleted, it keeps the tracelet for one minute. Directly retire the tracelet without any timeouts after dumping it a final time and store the rendered string compressed in a second list (which has a maximal length, appending if full will push the oldest element out).
If the API functions for dump, close etc can't find an active tracelet,