docs: Add section on matchBinaries behavior with shebang scripts

Clarify that matchBinaries matches against the interpreter binary rather
than the script path when executing scripts with shebangs, since the
kernel executes the interpreter and passes the script as an argument.

Signed-off-by: ariosmon <[email protected]>

Author: ariosmon

docs/content/en/docs/concepts/tracing-policy/selectors.md

@@ -328,6 +328,35 @@ while the whole `kprobe` call is the following:
       - "3"
 ```
 
+
+### Scripts with shebangs
+
+{{< caution >}}
+`matchBinaries` matches against the `interpreter`, not the script path.
+{{< /caution >}}
+
+When executing a script with a shebang (`#!/usr/bin/python3`), Linux actually runs the
+interpreter and passes the script as an argument. Since `matchBinaries` filters based on
+what the kernel is executing, it sees `/usr/bin/python3`, not `/opt/scripts/my_script.py`.
+
+This won't work:
+
+```yaml
+- matchBinaries:
+  - operator: "In"
+    values:
+    - "/opt/scripts/my_script.py"
+```
+
+Match the interpreter instead:
+
+```yaml
+- matchBinaries:
+  - operator: "In"
+    values:
+    - "/usr/bin/python3"
+```
+
 ## Parent binaries filter
 
 {{< warning >}}