eBPF: Connecting with Container Runtimes

Re:eBPF: Connecting with Container Runtimes by debatem1 on Thursday July 10, 2025 @11:09PM (#44528073)

None of these snippets appear to involve eBPF at all?

[ Parent | on HN ]

Re:eBPF: Connecting with Container Runtimes by forxtrot on Friday July 11, 2025 @01:15AM (#44528618)

Correct no eBPF-code is directly involved. As post explores eBPF-based tools for understanding user-space connection with container-runtime and enrichment of event once received from kernel-space.

[ Parent | on HN ]

Re:eBPF: Connecting with Container Runtimes by desiderantes on Friday July 11, 2025 @01:41AM (#44528721)

Hi, this is a nonsensical reply, as the sentence is lacking a few words to be complete. Are you using some kind of AI to answer? If so, which one?

[ Parent | on HN ]

Re:eBPF: Connecting with Container Runtimes by forxtrot on Friday July 11, 2025 @01:54AM (#44528780)

No A.I, just H.I (Human Intelligence) :).

[ Parent | on HN ]

Re:eBPF: Connecting with Container Runtimes by yjftsjthsd-h on Friday July 11, 2025 @02:33AM (#44528975)

> As post explores eBPF-based tool

What ebpf-based tool(s)? It looks like it's just sample code to open a socket to a CRI.

[ Parent | on HN ]

Re:eBPF: Connecting with Container Runtimes by forxtrot on Friday July 11, 2025 @03:00AM (#44529120)

The snippets are taken from cilium/tetragon, aquasecurity/tracee and crictl as mentioned in the post.

The post doesn't covers these projects in depth, instead act as a quick reference to the parts, where connection with CRI is being made and used for enrichment.

I understand there are more better ways to do the thing.

P.S: Post is a collection of my memories, when I was implementing the functionality. So just wanted to share, in hope that, maybe it will help others as well. Thanks !

[ Parent | on HN ]