Run loads the eBPF probes (exec/connect/openat), reads events from the ring
buffer, enriches each with a container id derived from the task's cgroup, and
writes one normalized telemetry event per line (JSONL) to out. It blocks until
SIGINT/SIGTERM. Requires root or CAP_BPF + CAP_PERFMON.
Documentation
¶
Source Files