Federico Di Pierro

@cristiklein can you try using `evt.rawarg.uid` instead?

So, i just tried to repro this with [`sinsp-example`](https://github.com/falcosecurity/libs/tree/master/userspace/libsinsp/examples) from libs master, that is a small executable on top of libsinsp, and it seems i receive events correctly: ``` sudo...

https://github.com/falcosecurity/libs/pull/1428 will fix the `rawarg` issue ;) Also, about: > As you can see %evt.args contains the correct uid, but `%evt.arg.uid% does not. `%evt.arg.uid` is resolved to the user name...

Yep, IMHO this is not a bug: if user 1000 is not existing in the container, it is fine to return NA username, right? At the same time, if you...

But please note: ``` docker run --rm --user 1000 busybox whoami whoami: unknown uid 1000 ``` I still think `NA` is the proper answer here.

> docker knows nothing about user 1000 because is a user outside the container, I am not sure what `--user` does, but i guess it just sets `setuid` for the...

/milestone 0.17.0

/remove-lifecycle stale

Agree! :+1: from my side.

There is an issue with changing CHAT window size, that is the same issue that prevent slack to support terminal resize: given our data structure where messages are splitted every...