bpf

Is your feature request related to a problem? Please describe.

I fiddled around with bpftrace to write internal documentation for my colleagues on how to use it. I chose tracepoint:syscalls:sys_enter_mkdir as a suitable tracepoint for a simple demo, and wrote this code:

bpftrace -e 'tracepoint:syscalls:sys_enter_mkdir { printf("mkdir %s %o\n", str(args->pathname), args->mode); }

At the moment of writing this issue, kubectl trace only supports X86-64 as target architecture.

The tool should be able to schedule bpftrace programs against all the architectures supported by bpftrace, that are X86-64 and arm64 (aarch64) see the Cmake definition.

To achieve that we n

Currently we have just one type of docs which are "reference" documentation. We should add a "how-to/tutorials" section with goal-driven content. We can start by drawing already available content:

https://blog.aquasec.com/kubernetes-runtime-security-ebpf
https://blog.aquasec.com/tracee-runtime-malware-alerts-aqua-postee
https://blog.aquasec.com/runtime-security-tracee-rules
https://github.co

kinvolk/inspektor-gadget#163 introduced support for a new hook mode based on NRI (Node Resource Interface). Currently this mode only works if the user explicitly pass the --hook-mode=nri option and it's not considered when --hook-mode=auto is used.

Inspektor Gadget should detect if containerd v1.5+ is used as runtime and set HOOK_MODE="podinformer" in the followin

Details: https://github.com/libbpf/libbpf/wiki/Libbpf:-the-road-to-v1.0#libbpfh-high-level-apis

Can we get some performance comparison between polycube and using standard linux facilities (NAT, iptables, etc.)?

CPU usage, PPS, latencies, etc.

Tasks:

• Explain current structure for system tests
• How to add new test?
• How to check coverage?
• How to integrate newly added test in the overall system test so that it can run as part of CI/GH-action?

Expected Output:

• document explaining above with sample test

nhi currently supports only systemd

All tools from bpfcc/libbpf-tools project should be portable to libbpfgo if libbpfgo supported all features present in libbpf.

This can be a good source of supportability, tests and tools.

Initial suggestion is to bring:

• bindsnoop
• biolatency
• biopattern

and then move on with the list.

We can sync .bpf.c portion of