ebpf

Search before asking

• I had searched in the issues and found no similar feature requirement.

Description

We should provide multi-architecture Docker images of skywalking-eyes, just like other SkyWalking sub-projects.

Use case

No response

Related issues

No response

Are you willing to submit a PR?

• [

Seems we have some language features not fully documented (like bitshift operators in #1322).

Would be good to go through language grammar and make sure everything is in the reference guide.

Describe the bug
I'm attempting to deploy Pixie into a k3s cluster which is listed as supported in the Pixie docs.

The Cluster type is supported check passes, but then fails later saying the cluster type isn't in the list of known supported types.

I'm able to manually proceed with the dep

Currently we have just one type of docs which are "reference" documentation. We should add a "how-to/tutorials" section with goal-driven content. We can start by drawing already available content:

https://blog.aquasec.com/kubernetes-runtime-security-ebpf
https://blog.aquasec.com/tracee-runtime-malware-alerts-aqua-postee
https://blog.aquasec.com/runtime-security-tracee-rules
https://github.co

At the moment of writing this issue, kubectl trace only supports X86-64 as target architecture.

The tool should be able to schedule bpftrace programs against all the architectures supported by bpftrace, that are X86-64 and arm64 (aarch64) see the Cmake definition.

To achieve that we n

Folks who are new to Golang might have trouble doing the go mod tidy/vendor/verify dance. It would be nice to provide some better instructions in developer docs to avoid headaches.

It appears that the RedBPF toolchain imposes currently undocumented restrictions on map value types that go beyond those expressed by the generic constraints:

• All variants of an enum must have the same size in memory.
• Struct fields are (mostly?) required to be aligned to multiples of 32 bits, though sometimes 64-bit alignment is required, and some structs don't work at all despite their fi

Feature Request

Short Description

Currently, the system tests that we have are all based on k8s environment. We need few tests in systemd mode as well. The tests should atleast cover:

1. running kubearmor in systemd mode
2. applying sample policy using karmor
3. verifying alerts using karmor on violation of those policies

Describe the solution you'd like

Task involved:

Bug Description

【question】

   pilot-agent-69571   [006] d... 270197.943731: bpf_trace_printk: [debug] get current pod ip error
     pilot-agent-69571   [006] d... 270197.943738: bpf_trace_printk: [debug] call from sidecar container: cookie: 780438927, ip: 0xa9fcf8ac, port: 8080
     pilot-agent-91591   [030] d... 270198.324635: bpf_trace_printk: [debug] get current pod ip error
     

Can we get some performance comparison between polycube and using standard linux facilities (NAT, iptables, etc.)?

CPU usage, PPS, latencies, etc.

Since the kernel's libbpf seems to handle .text ELF sections gracefully, we should probably do that too.