Rafael David Tinoco

I have converted this to draft so this is not lost (for my reference) BUT it is likely that this won't be merged because of the new networking code. Either...

Sorry, I realized there are missing PRs for this case. Please link PRs to the issues so we can track them altogether. Thanks!

 With the change we made, we have already probably got rid of most of the false positives. There is still a catch from Yaniv's comment that we could address,...

@AlonZivony could you provide an example of breakage ? When it happened recently, which commit, etc ? Also, the work started the **go-cel proof-of-concept**, with a **protobuf** wrapper, started to...

@NDStrahilevitz your input here pls. How did we plan to advertise the "protocol" version ? I believe this is important for the golang signatures, working as plugins and using types...

> Unless, we make the choice to give up genericness from event sources, and then we should opt to change the body type of `protocol.Event` to `trace.Event` from `interface{}`. That...

> Can't go-cel work with the protobuf Any type? Currently for our protocol.Event that's what we should use in a protobuf. We would need to check that in go-cel. Then...

@NDStrahilevitz I believe this case is not directly related to #1922, but if we decide to go with a side channel for janitor events, then it could be related.

I'm preparing a "mid-term" (that won't solve this issue) change allowing one to execute "Makefile.one" based containers for "tracee-ebpf" and "tracee" (tracee-ebpf + tracee-rules) using shell entrypoints. I believe this...

And, for now, we're also thinking on: https://github.com/aquasecurity/tracee/issues/2038 to make end user (docker container) life easier.