{"id":17255372,"url":"https://github.com/krisnova/double-slit-experiment","last_synced_at":"2025-04-14T05:41:44.262Z","repository":{"id":48623224,"uuid":"384867739","full_name":"krisnova/double-slit-experiment","owner":"krisnova","description":"Identify containers at runtime and observe them. No container runtime required. Read only access to the kernel.","archived":false,"fork":false,"pushed_at":"2021-07-24T06:10:13.000Z","size":115,"stargazers_count":17,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-27T19:39:41.933Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/krisnova.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-07-11T05:31:07.000Z","updated_at":"2025-03-01T08:12:32.000Z","dependencies_parsed_at":"2022-08-29T05:31:20.218Z","dependency_job_id":null,"html_url":"https://github.com/krisnova/double-slit-experiment","commit_stats":null,"previous_names":["kris-nova/double-slit-experiment"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/krisnova%2Fdouble-slit-experiment","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/krisnova%2Fdouble-slit-experiment/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/krisnova%2Fdouble-slit-experiment/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/krisnova%2Fdouble-slit-experiment/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/krisnova","download_url":"https://codeload.github.com/krisnova/double-slit-experiment/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248830424,"owners_count":21168272,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-15T07:11:26.563Z","updated_at":"2025-04-14T05:41:44.242Z","avatar_url":"https://github.com/krisnova.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Linux Telemetry\n\n**The Double Slit Experiment**\n\nTaken from an [interesting physics anomaly](https://en.wikipedia.org/wiki/Double-slit_experiment) where the behavior of a physical system mutates simply by being observed.\n\nThe thesis behind the project is that meaningful well thought out telemetry could change the behavior of broader systems.\n\n---\n\n# Install\n\n```bash \ngit clone git@github.com:kris-nova/double-slit-experiment.git\ncd double-slit-experiment\nmake\n./dse --help\n```\n\n# Running\n\n```bash\n./dse run | uniq\n```\n\n**Note**: See `userspace/profile.go` for filters and configuration for now.\n\n# About\n\nThis is a library of abstractions build around Go and eBPF code. \n\nThe library will aggregate events from the Linux kernel at runtime using [eBPF](https://ebpf.io/).\n\nThe abstractions are `ObservationPoint`'s. These are aggregate systems in Go built around [tracepoints](https://www.kernel.org/doc/html/latest/trace/tracepoints.html) in the Linux kernel.\n\n - ProcessExecuted _An event for every process executed on the system_\n - ContainerEvent _An event for any new container (docker, kubernetes, etc) started on the system_\n - SocketStateChange _An event for any change in a socket on the system_\n - SignalDelivered _An event for every Linux signal delivered to a process on the system_\n\nEach `ObservationPoint` returns one or more events that each implement the `Event` interface.\n\n```go \n// Event is a generic event for all\n// ObservationPoint systems.\ntype Event interface {\n\tJSON() ([]byte, error)\n\tString() string\n\tName() string\n}\n```\n\n# Filters\n\nThe Double Slit Experiment has two types of filters that can be applied to various Observation Points.\n\n - SelectFunction() _Select ANY that match this condition_\n - DropFunction() _Drop ANY that match this condition_\n\nFilters are managed different for each Observation Point, however `drop` functions drop as soon as a match is found.\n\nSelect functions are active, meaning they will drop any data that does not match the select.\n\nConsider the following stream of data where all integers 0 through 9 were sent through systems `select()` and `drop()`. \n\n```go\npackage main\n\nfunc main() {\n\tdata := []int{0, 1, 2, 3, 4, 5, 6, 7, 8, 9}\n\tfor _, n := range data {\n\t\tselectFunction(n)\n\t\tdropFunction(n)\n    }\n}\n```\n\nSelect functions will return data that matches a condition (similar to [Unix](https://en.wikipedia.org/wiki/Filter_(software)#Unix)'s `grep` by Ken Thompson).\n\n```go\npackage main \n\nfunc selectSeven(n int) bool {\n    return n == 7\n}\n// output: _, _, _, _, _, _, _, 7, _, _,\n```\n\nDrop functions will drop data that matches a condition. \n\n```go\nfunc dropSeven(n int) {\n\treturn n != 7\n}\n// output: 0, 1, 2, 3, 4, 5, 6, _, 8, 9\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkrisnova%2Fdouble-slit-experiment","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkrisnova%2Fdouble-slit-experiment","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkrisnova%2Fdouble-slit-experiment/lists"}