How do I complie and install tracee directly to a Host instead of a container

[leiqi96]

nothing

[rafaeldtinoco]

1. clone the repository (github.com/aquasecurity/tracee)
2. make sure to have submodules initialized (3rdparty/libbpf) with git submodule {init,sync,update}
3. make sure to have build dependencies installed (libelf-dev, zlib1g-dev)
4. run make
5. execute ./dist/tracee-ebpf with ./dist/tracee-rules like the example shown at entrypoint.sh.

Note that, while we're still not packaging tracee-ebpf nor tracee-rules, you can compile static versions of tracee-ebpf by running make with STATIC=1:

4. STATIC=1 make

$ ldd ./dist/tracee-ebpf
	not a dynamic executable