forxtrot

That's good point. I will add inline links. Thanks !

See the approaches used for handling eBPF-events in user-space by opensource projects.

Thanks for giving the context.

The snippets are taken from cilium/tetragon, aquasecurity/tracee and crictl as mentioned in the post.

The post doesn't covers these projects in depth, instead act as a quick reference to the parts, where connection with CRI is being made and used for enrichment.

I understand there are more better ways to do the thing.

P.S: Post is a collection of my memories, when I was implementing the functionality. So just wanted to share, in hope that, maybe it will help others as well. Thanks !

No A.I, just H.I (Human Intelligence) :).

Correct no eBPF-code is directly involved. As post explores eBPF-based tools for understanding user-space connection with container-runtime and enrichment of event once received from kernel-space.