Tracee v0.3.0 released!

[itaysk]

Release: https://github.com/aquasecurity/tracee/releases/tag/v0.3.0

Notable changes:

• migrated from bcc to libbpf
• you can now choose if Tracee will build the eBPF program at runtime (like before), or you can pre-compile it and provide it at runtime
• if Tracee is not building the eBPF program, there are no runtime dependencies. If it is, clang is now required (instead of bcc)
• new "slim" version of the Docker image excludes all the build dependencies for when the eBPF program is pre-built
• improved local building experience. Makefile is rewritten to be more robust, and new targets supports building in a Docker container with all the dev dependencies baked in (with DOCKER=1).
• much faster load time
• --trace flag that allows to trace different targets (contributed by @pathtofile)
• --filter flag that allows to filter events in kernel (currently only by UID) (contributed by @grantseltzer)
• output format using Go Templates (contributed by @siddharths2710)

Notable fixes:

• correctly parse sockaddr_t
• trace memfdfiles in vfs_write
• support huge strings from as args
• don't crash when capture exec an empty path

Related videos:
https://youtu.be/klNx6w3EtWM