v0.16.0

Docker Image (x86_64 only)

• docker pull docker.io/aquasec/tracee:0.16.0

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.16.0
• docker pull docker.io/aquasec/tracee:aarch64-0.16.0

What's Changed

• make: set LIBBPFGO_OSRELEASE_FILE default value by @geyslan in #3226
• chore: migrate to golang-lru v2 by @NDStrahilevitz in #3140
• (extensions) probes: create probe group, events: start work by @rafaeldtinoco in #3223
• flags: refactor FilterMap by @yanivagman in #3222
• go.mod: remove types replace by @NDStrahilevitz in #3236
• containers: trim mountpoint from stored paths by @NDStrahilevitz in #3231
• docs: remove old trace subcommand by @geyslan in #3238
• ebpf: pipeline: reduce iteration over policies by @geyslan in #3209
• engine: fix panic on waitgroup by @josedonizetti in #3233
• Update packaging.md for Ubuntu package building by @pimvh in #3243
• ebpf: fix socket_accept event by @NDStrahilevitz in #3240
• fix: fix container edge case in events pipeline by @geyslan in #3253
• tracee: skip golang plugin for static binaries by @josedonizetti in #3244
• Fix typo in Vagrantfile's comment by @64J0 in #3260
• tracee: signatures-dir accept multiple values by @josedonizetti in #3246
• change hooked_syscalls event so users can specify syscalls to check. by @AsafEitani in #3136
• events: hidden_kernel_module changes by @OriGlassman in #3255
• config: extract config structs to its own pkg by @geyslan in #3228
• eBPF control plane signals by @NDStrahilevitz in #3237
• build: remove signing from snapshot by @josedonizetti in #3271
• release: bump release tag to 0.16.0 by @josedonizetti in #3272
• fix: send init events to pipeline by @geyslan in #3270
• thread-safety issues fix by @rafaeldtinoco in #3265
• fix(pkg/events): fix tailcall dependencies race issues by @rafaeldtinoco in #3274
• build: remove release on tag push by @josedonizetti in #3273
• chore: move syscaller to dist by @geyslan in #3269
• fix(tests): fix input paths in parsecmd test by @rafaeldtinoco in #3275
• tracee: add analyze cmd by @josedonizetti in #3101
• policies: rename list fields to be plural by @josedonizetti in #3242
• [v0.16.0] fix(pkg/counter): finish making counter atomic (#3276) by @rafaeldtinoco in #3284
• [v0.16.0] fix: derived event not triggering if base filtered by @josedonizetti in #3287
• [v0.16.0] fix: enrich post control plane (#3285) by @NDStrahilevitz in #3289

New Contributors

• @pimvh made their first contribution in #3243
• @64J0 made their first contribution in #3260

Full Changelog: v0.15.1...v0.16.0