aquasecurity / tracee

Linux Runtime Security and Forensics using eBPF
https://aquasecurity.github.io/tracee/latest
Apache License 2.0
3.6k stars 415 forks source link

Revisit the purpose of /tmp/tracee/out/tracee.pid readiness file #1548

Open danielpacak opened 2 years ago

danielpacak commented 2 years ago

It seems that we used tracee.pid file along with a Bash script snippet in the entrypoint.sh as a readiness check when compiling the BPF object was part of tracee-ebpf logic.

Things have changed and we no longer compile BPF nor use tracee.pid in entrypoint.sh as readiness check. What's more, tracee.pid is created early on when tracee-ebpf starts and cannot be considered as reliable readiness check as shown in #1540.

danielpacak commented 2 years ago

Beyond that, having readiness logic spread across Go code and entrypoint.sh is not applicable to the release tarball that only contains tracee-epbf and tracee-rules executable binaries without entrypoint.sh.