Rafael David Tinoco

If there isn't an issue for mapping the supported runtimes (I believe there was one at sometime) then I would recommend creating an issue for it with a more consumable...

Using `microk8s` and it uses containerd (unix:///run/containerd/containerd.sock) and sysfs: cgroup container entry is is ``` /sys/fs/cgroup/kubepods/burstable/pod63a1179e-5810-4719-860e-4aeeafe24743/016a33241f9385b12e1c4f2fa7a95d7458a5ada3a6a5b15d77b7a76d9972a665 ``` For microk8s, I can register the default location for the socket: ```console /snap/microk8s/current/bin/ctr...

I loved the event! It LGTM, definitely. There are just minor spell nits, some comments to be added to make it easier to understand your intents (if my interpretation is...

@AlonZivony mind rebasing this one and solving the little conflict it has ?

@AlonZivony 

Rebasing at https://github.com/aquasecurity/tracee/pull/3688 (and minor fix to the test that failed). > edit: it also needed another small fix (https://github.com/aquasecurity/tracee/pull/3688/commits/58820791137cff9f7b1adb375042c09f8ff768ac)

I tried to fix the conflict using web interface but it creates a merge and messes up with history and other things. I'll rebase at: https://github.com/aquasecurity/tracee/pull/3696 (and run tests multiple...

 Tests passed quickly because there were no tests. The workflow had a bad syntax so the tests did not run. Weird.

Let me check what is going on in that PR (just a rebase of this one).

Alright, so there is a problem here. The event fails in some kernels and it doesn't in some others (https://github.com/aquasecurity/tracee/actions/runs/6895648514/job/18760277375?pr=3696). I think there are 2 issues: 1. Related to timing...