first of all, thanks for the ps aux mistake, I fixed it (the correct entry point is `tiny -- /run.sh`)

regarding the question, it depends on the use case, I'm mainly tracking servers which are not terminated therefore it works good enough for me but of course if I'm capturing clients (for example curl) it might be problematic for such use-cases we have additional fallbacks, adding the kernel comm task along with the PID, or to hook `execv` and `fork` to have more time before the process is being terminated