Red Hat Blog: Performance tracing of Podman using eBPF

… time of a container in eBPF is done by following the dependency graph of parent processes and their children back to the initial Podman command executed in its own process. This logic is implemented in fork_exec_snoop.bt. In the bpftrace file, a high-level tracing language is used to interact with the Linux BPF system.