Melissa Kilby

@jasondellaluce and @Andreagit97 and others it may be time for better container engine testing, we keep breaking it see latest oversight (that was on me) https://github.com/falcosecurity/libs/pull/1535

/remove-lifecycle stale Some new e2e test efforts are a WIP @therealbobo

Do we still need this?

/remove-lifecycle rotten

Agreed.

Thanks @stevenbrz. In fact, I've been thinking about pushing more functionality like filtering into the kernel driver ever since I started contributing. However, reality set in quickly ... Here are...

> Yeah it's a tricky balance. If this feature is disabled by default and remains an advanced/experimental setting (with these tradeoffs documented), could it be easier to argue its inclusion?...

@stevenbrz just occurred to me: Could you try using the modern BPF driver instead (you use kernel 5.15 and are therefore eligible for it)? Try increasing the number of CPUs...

:exploding_head: scap event rates are over 21 Million / second !!! The libbpf stats (which you hadn't turned on) tracepoint invocation rates must be off the roof. I hate to...

> This is all great information, thank you! I'll look into what you said about enter events. You should be able to return and drop out early before making the...