Method load

pkg/agent/hooks/linux/hooks.go:111–431

(ctx context.Context, opts agent.HookCfg, setupOpts config.Agent)

}

func (h *Hooks) load(ctx context.Context, opts agent.HookCfg, setupOpts config.Agent) error {
	// Allow the current process to lock memory for eBPF resources.
	if err := rlimit.RemoveMemlock(); err != nil {
		utils.LogError(h.logger, err, "failed to lock memory for eBPF resources")
		return err
	}

	// Load pre-compiled programs and maps into the kernel.
	objs := bpfObjects{}
	bpfopts := &ebpf.CollectionOptions{
		Programs: ebpf.ProgramOptions{
			LogLevel:     ebpf.LogLevelInstruction | ebpf.LogLevelBranch,
			LogSizeStart: 1 * 1024 * 1024,
		},
	}

	spec, err := loadBpf()
	if err != nil {
		utils.LogError(h.logger, err, "failed to load BPF spec")
		return err
	}

	programs := []struct {
		name  string
		pType ebpf.ProgramType
		aType ebpf.AttachType
	}{
		{"k_sockops", ebpf.SockOps, ebpf.AttachCGroupSockOps},
	}

	for _, p := range programs {
		if prog, ok := spec.Programs[p.name]; ok {
			prog.Type = p.pType
			prog.AttachType = p.aType
		}
	}

	// Now load and assign into the kernel with the corrected spec
	if err := spec.LoadAndAssign(&objs, bpfopts); err != nil {
		var ve *ebpf.VerifierError
		if errors.As(err, &ve) {
			fmt.Printf("VERIFIER FAILURE:\n%s\n", strings.Join(ve.Log, "\n"))
		} else {
			fmt.Printf("SYSCALL FAILURE: %v\n", err)
		}
		return err
	}
	//getting all the ebpf maps with proper synchronization
	h.objectsMutex.Lock()
	h.clientRegistrationMap = objs.KeployClientRegistrationMap
	h.agentRegistrationMap = objs.KeployAgentRegistrationMap
	h.objects = objs
	h.objectsMutex.Unlock()
	// ---------------

	// In DaemonSet mode the CRD-scoped SessionReconciler is the SOLE owner of
	// target_namespace_pids — it arms exactly the recorded pods' TGIDs, and the
	// proxyless capture reads that map. The sys_enter_socket tracepoint, by