Controlplane $ docker run --name tracee --rm --privileged -v /lib/modules/:/lib/ . . .

Avneet bansal:
controlplane $ docker run --name tracee --rm --privileged -v /lib/modules/:/lib/modules/:ro -v /usr/src:/usr/src:ro -v /tmp/tracee:/tmp/tracee -it aquasec/tracee:latest
Unable to find image ‘aquasec/tracee:latest’ locally
latest: Pulling from aquasec/tracee
540db60ca938: Pull complete
d1f87969be9d: Pull complete
dbfece38a189: Pull complete
fffa7b24a67e: Pull complete
5c0ba3d4b4e4: Pull complete
7906f4d77600: Pull complete
Digest: sha256:0f7d4fa6e53ae1966da29490b028ead5826211e1d89d3bf861c2ec310f0108c1
Status: Downloaded newer image for aquasec/tracee:latest
Loaded signature(s): [TRC-1 TRC-2 TRC-3 TRC-4 TRC-5 TRC-6 TRC-7]
2021/05/05 21:59:07 failed to make BPF object (clang): exit status 1. Try using --debug for more info

Vijin Palazhi:
I have updated this question. Instead of the latest tag, please make use of 0.4.0 tag which supports the --trace subcommand and flag container=new

Avneet bansal:
Thanks @Vijin Palazhi.