William Findlay

Just FYI, I've started on an early version of ringbuf support over at https://github.com/willfindlay/aya/tree/ringbuf. So far I only have a rough first cut at the BPF side of things, but...

@kkourt I can probably just do it here, I see TestChecker got merged already.

I've been using vagrant for this on a macOS host (only host that supports nested virtualization). Works quite well, though build times are a bit slow. For reference: - https://github.com/willfindlay/bpfcontain-rs/blob/master/.github/workflows/ci.yml...

> Hey team, > Howdy! Thanks for your interest in the project :) > After reading the announcement of the project, I've been eager and excited to play around and...

> having this example in the repo (under "local testing" or something) would be extremely useful Agreed, would be happy to take a PR. :)

This would probably need to hold off until we add BTF support to aya-bpf.

You need to compile your kernel with BTF info. Check for the existence of /sys/kernel/btf.

Alternatively, you can generate the BTF yourself and load it into the Tetragon pod but that's a bit more of an advanced use case.

https://www.kernel.org/doc/html/latest/bpf/btf.html#btf-generation This explains how to generate the BTF manually. You could then set the helm values such that this is mounted into the Tetragon container and used by Tetragon. Alternatively,...

If you end up going the first route, here are the helm values you're looking for: https://github.com/cilium/tetragon/blob/402d16f084669bccf1562dc4d2fda8554c0f3715/install/kubernetes/values.yaml#L14 https://github.com/cilium/tetragon/blob/402d16f084669bccf1562dc4d2fda8554c0f3715/install/kubernetes/values.yaml#L118