Tracee: Tracing Containers with eBPF

Aqua Security announces Tracee, an experimental open-source tool that uses eBPF to trace container-specific events. Tracee detects containers by watching for processes that appear as PID 1 inside new PID namespaces and then traces those processes and their children to capture syscalls and events (e.g., cap_capable); it focuses on container-only events and must be started before the containers to be traced. The project, authored by Yaniv Agman, supports common system calls and invites user feedback and contributions.