Stabilize flags UX

[yanivagman]

Many changes have been done over time to the flags used by tracee.
We recently introduced a new --filter flag, and there is an ongoing effort to consolidate several flags into it (#377) and integrate perf buffer size flags (#401).
We also want to integrate several other flags into the --capture and --output flags (#397).

I'm opening this discussion to list all the flags options after the above changes will be merged, so we can discuss any further desired changes we want to introduce to the flags UX. The purpose of the discussion is to stabilize the flags UX, so we won't need to make any major changes in the future (although new flags additions are definitly possible).
Any change to the flags UX we agree upon will be reflected in the following table:

flag	sub-command	description
--list, -l		list tracable events (default: false)
--trace, -t	uid{=,!=,<,>}uid1,uid2,...	trace specific uids
--trace, -t	pid{=,!=,<,>}pid1,pid2...	trace specific pids
--trace, -t	pid{=,!=}new	trace newly created processes
--trace, -t	pidns{=,!=,<,>}pidns1,pidns2...	trace specific pidns
--trace, -t	mntns{=,!=,<,>}mntns1,mntns2...	trace specific mntns
--trace, -t	uts{=,!=}name1,name2,....	trace specific uts namespace names
--trace, -t	comm{=,!=}comm1,comm2,...	trace specific command names
--trace, -t	event{=,!=}event1,event2,...	trace specific events
--trace, -t	set=set1,set2,...	trace specific sets of events (default: 'default')
--trace, -t	[!]container	trace container processes
--trace, -t	container{=,!=}new	trace processes from newly created containers
--trace, -t	event.argument=value	trace an event according to its argument value
--trace, -t	follow	trace filtered processes and all of their descendants as well
--output, -o	[format:]{table,json,gotemplate}=...	choose output format (default: table)
--output, -o	file:/path/to/file	write the output to a specific file (deafult: stdout)
--output, -o	option:{eot,stacktrace,detect-syscall,exec-env}	enrich output according to given options (default: none)
--capture, -c	[artifact:]exec	capture and save executed files
--capture, -c	[artifact:]mem	capture and save memory regions that changed protection from w+x to w
--capture, -c	[artifact:]write[=/path/prefix*]	capture and save data written to files
--capture, -c	[artifact:]all	capture and save all of the above forensic artifacts
--capture, -c	dir:/path/to/dir	path to save captured artifacts (default: /tmp/tracee/out)
--capture, -c	clear-dir	remove artifacts saved in previous executions from capture path (default: false)
--perf-buffer-size, -b	value	size of perf ring buffer used to submit events or send blobs from the kernel (default: 1024)
--perf-buffer-size, -b	blob:value	size of perf ring buffer used to send blobs (default: 1024)
--bpf-pin	map:map_name:/path	pin a bpf map to path
--security-alerts		alert on security related events (default: false)
--debug		write verbose debug messages to stdndard output and retain intermediate artifacts (default: false)
--install-path	/path	path where tracee will install or lookup it's resources (default: "/tmp/tracee")
--build-policy	{never,always,if-needed}	when to build the bpf program (default: "if-needed")
--help, -h		show help (default: false)
--version, -v		print the version (default: false)

[itaysk]

great summary!! it should be included in the readme as well
I would hold off this discussion until all PRs are merged because small things are still changing

[yanivagman]

Looking at this table, I think we can also integrate --perf-buffer-size and --blob-perf-buffer-size to --perf-buffer-size [blob:]value

[itaysk]

as we add more and more features, it becomes more fitting to configure tracee using a config file (in addition to flags)

[yanivagman]

We should update the readme once with all the changes before we release 0.4.0, as we are going to do a lot of flag changes, and this might confuse people who use the docker image