Comment by westurner

Cool tool! Is the inotify directory/file watch count the limit?

I can't seem to remember the name of the pre-containers tool that creates a virtual build root and traps all the file syscalls. It's not strace.

Easier to trace everything an AI runs by running the agent in a container with limited access to specific filesystem volumes.

eBPF is the fastest way to instrument in Linux AFAIU:

Traceleft: https://github.com/ShiftLeftSecurity/traceleft

Tracee: https://github.com/aquasecurity/tracee

Falco docs > Supported events: https://falco.org/docs/reference/rules/supported-events/

Tetragon: https://github.com/cilium/tetragon

strace could have a --diff-fs-syscall-files option:

  strace -p PID -f -F -e trace=file -s 65536