$ show aquasecurity/tracee
Tracee is a runtime security and observability tool that uses eBPF to trace system events and detect threats. It consists of multiple Go binaries: a main security agent (`tracee`) that loads eBPF programs, collects kernel events, and runs detection rules; a gRPC client (`traceectl`) for remote management; an event generator (`evt`) for stress testing; and a Kubernetes operator. The architecture is modular with a clear separation between eBPF event collection, event derivation and enrichment pipelines, data stores (process tree, container info, DNS cache, kernel symbols), a detection engine supporting both Go signatures and YAML-based rules using CEL expressions, and filtering/policy subsystems. The system operates as a daemon with HTTP/gRPC endpoints for metrics, health, and streaming event output, and integrates deeply with Kubernetes via CRDs and controllers. The codebase demonstrates strong engineering with clean abstractions (filter interfaces, data store registries, event derivation framework), reusable utility packages (bucketcache, changelog, string interning, fuzzy parsing), and comprehensive testing including unit, integration, and e2e tests. However, it exhibits technical drift in areas like multiple Go modules with `replace` directives, hardcoded kernel version checks in eBPF probe logic, legacy signature conversion code planned for removal, and some global mutable state. The eBPF C code is complex and kernel-version-sensitive, requiring ongoing maintenance. Overall, it is a well-crafted, production-grade security tool suitable for container and Kubernetes environments.
The LLM identified 7 files worth highlighting for reuse:
A generic, thread-safe LRU cache with configurable bucket count and eviction callbacks. Uses `hash/fnv` for sharding and per-bucket mutexes to reduce contention. Demonstrates non-obvious concurrency optimization for high-throughput event pipelines. Can be extracted and reused in any Go project needing a concurrent cache with bounded size.
A size-bounded, time-keyed circular buffer that maintains the most recent values for each key, with per-tick capacity limits. Supports iteration and pruning of stale entries. Used by `TaskInfo` in process tree for point-in-time queries. A clean, reusable data structure for caching time-ordered state changes in event-driven systems.
Thread-safe string interning using Go 1.21's `unique` package (or a sync.Map fallback). Deduplicates frequently repeated strings (process names, container IDs, paths) to reduce memory pressure in the event pipeline. Includes benchmark demonstrating significant allocation savings. Extractable for any Go service with high-string-cardinality workloads.
Comprehensive event filtering framework with support for multiple filter types (string, numeric, bool, process tree, binary) and scope expressions. Implements `FilterProto` method for zero-allocation filtering against protobuf events, and `ConvertFromProto` for bidirectional parity. Demonstrates well-factored filter interfaces with cloning, merging, and negation support. Highly reusable for any event processing system.
Efficient process tree implementation using hash maps (global PID hash, per-namespace hashes), LRU caches with eviction callbacks, and `sync.Pool` for feed objects (ForkFeed, ExecFeed, ExitFeed). Supports thread-safe access, async procfs feeding, and clean up of dead entries. A well-optimized structure for maintaining process lineage in event-driven systems.
Registers custom CEL functions (split, join, trim, replace, upper, lower, basename, dirname) for use in YAML detector conditions. Demonstrates robust type-assertion handling for various CEL value types and provides a clean extension point for domain-specific expression language features. Reusable in any project using CEL for rule evaluation.
Generic event derivation framework with helper functions `deriveSingleEvent`, `deriveMultipleEvents`, and `deriveMultiDerivation`. Uses well-defined error handling and supports parallel derivation strategies. Provides a clean abstraction for creating higher-level events from raw kernel events. The pattern is reusable in any event processing pipeline.