Support monitoring short-lived processes in the access log module

[mrproliu]

No description provided.

[Copilot]

Pull request overview

This PR extends the access log module to capture and attribute short-lived processes by observing exec/fork events from the kernel and resolving those events back to containers (preferably via cgroup v2), closing the visibility gap left by periodic /proc scanning.

Changes:

• Add cgroup-v2-based container resolution (including configurable host /sys mapping) and integrate it into the Kubernetes process finder.
• Add a kernel-driven “process execution” pipeline (BPF maps + perf events + userspace verdict tracking) so short-lived processes can be monitored from their first syscalls.
• Extend process finder/module APIs and templates to support “executing process” contexts and fallback naming when /proc/<pid>/cmdline is unavailable.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/tools/host/file.go	Adds host /sys path resolution with an env-configurable mapping for containerized/nested environments.
pkg/tools/host/file_test.go	Tests host /sys mapping behavior.
pkg/tools/cgroup/resolver.go	Introduces a cgroup v2 tree walker to map cgroup inode IDs to container IDs.
pkg/tools/cgroup/resolver_test.go	Adds comprehensive tests for cgroup walking/mapping, depth-independence, and availability probing.
pkg/process/module.go	Exposes new process-module APIs for “executing process” decisions and cgroup ID resolution.
pkg/process/finders/manager.go	Adds manager-level support for executing-process finders and cgroup ID resolution across finders.
pkg/process/finders/manager_executing_test.go	Tests gating logic for whether executing-process reporting is enabled.
pkg/process/finders/kubernetes/template.go	Plumbs a fallback process name into template rendering for exited processes.
pkg/process/finders/kubernetes/finder.go	Adds cgroup resolver integration and executing-process handling for Kubernetes processes.
pkg/process/finders/base/template.go	Adds fallback cmdline behavior in template process context for exited/zombie processes.
pkg/process/finders/base/finder.go	Introduces the optional ExecutingProcessFinder interface.
pkg/process/api/process.go	Adds ProcessExecuteContext describing kernel-captured start-time process metadata.
pkg/process/api.go	Extends process Operator API and adds optional CgroupOperator for kernel-space filtering support.
pkg/accesslog/common/connection.go	Adds cgroup allowlist / per-process rejection filtering modes and process verdict tracking for exec/fork monitoring.
pkg/accesslog/collector/process.go	Switches to exec+fork tracepoints and decodes richer process-exec events (pid, cgroup id, comm).
CHANGES.md	Documents support for monitoring short-lived processes in access log module.
bpf/accesslog/process/process.h	Adds BPF maps/flag for cgroup allowlisting vs per-process rejection filtering.
bpf/accesslog/process/process.c	Implements exec/fork reporting, kernel-side filtering, and richer process execute events.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.