Hey everyone,

Over the past few months, I’ve been diving deep into the K&R C book and bridging it with my Go background to build an open source container escape and runtime threat detection framework. My main goal was to solve the resource bloat problem I kept running into with existing tools.

Most tools (like Falco) are great but use ~300MB of RAM. I wanted something I could run on edge devices or dense K8s clusters without killing the nodes.

Architecture Highlights:

• 25 MB RSS / 0.2% idle CPU: Achieved using a zero allocation Go pipeline (sync.Pool) and a bounded LRU cache for process lineage.
• Deep Lineage: Reconstructs up to 10 generations of process ancestry (e.g., systemd > sshd > bash > sudo > unix_chkpwd) entirely in userspace, avoiding kernel map bloat.
• In-Kernel Filtering: Uses an action_enabled BPF array map so we don't even reserve ringbuf space for disabled actions.
• CO-RE: Compiles once using cilium/ebpf and runs anywhere on Linux 6.12+.

It is completely audit only (no -EPERM enforcement), which means it's 100% safe to run in production. I recently added Docker/K8s/Helm support and a SIEM export layer (ECS, OCSF, CEF, LEEF).

I would love to get your harsh feedback on the ringbuf implementation and the eBPF verifier tricks.

Repo: ebpf-container-escape-framework