diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 4cc5108..607d628 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -3,12 +3,17 @@ find_package(nlohmann_json REQUIRED)
 include_directories(${PROJECT_SOURCE_DIR})
 include_directories(${CMAKE_CURRENT_SOURCE_DIR})
 
+add_library(optional SHARED optional.cpp execsnoop.cpp)
+target_link_libraries(optional bcc)
+install(TARGETS optional DESTINATION /usr/lib/cgproxy/ PERMISSIONS ${basic_permission})
+
 add_executable(main main.cpp
-                    common.cpp config.cpp cgroup_attach.cpp 
+                    common.cpp config.cpp cgroup_attach.cpp
                     socket_client.cpp socket_server.cpp)
- 
-target_link_libraries(main nlohmann_json::nlohmann_json Threads::Threads bcc)
+
+target_link_libraries(main PRIVATE nlohmann_json::nlohmann_json Threads::Threads)
+target_link_libraries(main PRIVATE optional)
 set_target_properties(main PROPERTIES LINKER_LANGUAGE CXX)
 set_target_properties(main PROPERTIES OUTPUT_NAME cgproxy)
 
-install(TARGETS main   DESTINATION /usr/bin PERMISSIONS ${basic_permission})
+install(TARGETS main DESTINATION /usr/bin PERMISSIONS ${basic_permission})
diff --git a/src/cgproxyd.hpp b/src/cgproxyd.hpp
index f36055d..4520868 100644
--- a/src/cgproxyd.hpp
+++ b/src/cgproxyd.hpp
@@ -4,7 +4,6 @@
 #include "cgroup_attach.h"
 #include "common.h"
 #include "config.h"
-#include "execsnoop.hpp"
 #include "socket_server.h"
 #include <algorithm>
 #include <csignal>
@@ -15,6 +14,7 @@
 #include <sched.h>
 #include <sys/file.h>
 #include <unistd.h>
+#include "optional.h"
 
 using namespace std;
 using json = nlohmann::json;
diff --git a/src/execsnoop.hpp b/src/execsnoop.cpp
similarity index 84%
rename from src/execsnoop.hpp
rename to src/execsnoop.cpp
index 1df2714..0412e04 100644
--- a/src/execsnoop.hpp
+++ b/src/execsnoop.cpp
@@ -1,7 +1,3 @@
-#ifndef EXECSNOOP_HPP
-#define EXECSNOOP_HPP 1
-
-#include <exception>
 #include "bcc/BPF.h"
 #include "common.h"
 #include <bcc/libbpf.h>
@@ -93,19 +89,4 @@ int execsnoop() {
   return 0;
 }
 
-struct thread_arg {
-  function<int(int)> handle_pid;
-};
-
-void *startThread(void *arg) {
-  thread_arg *p = (thread_arg *)arg;
-  callback = p->handle_pid;
-  try {
-    execsnoop();
-  } catch (exception &e) {
-    error("bcc may not be installed, %s",e.what());
-  }
-  return (void *)0;
-}
-} // namespace CGPROXY::EXESNOOP
-#endif
\ No newline at end of file
+} // namespace CGPROXY::EXESNOOP
\ No newline at end of file
diff --git a/src/execsnoop.h b/src/execsnoop.h
new file mode 100644
index 0000000..f496036
--- /dev/null
+++ b/src/execsnoop.h
@@ -0,0 +1,17 @@
+#ifndef EXECSNOOP_HPP
+#define EXECSNOOP_HPP 1
+
+#include <functional>
+#include <string>
+using namespace std;
+
+namespace CGPROXY::EXESNOOP {
+
+extern const string BPF_PROGRAM;
+struct data_t;
+extern function<int(int)> callback;
+void handle_events(void *cb_cookie, void *data, int data_size);
+int execsnoop(); 
+
+} // namespace CGPROXY::EXESNOOP
+#endif
\ No newline at end of file
diff --git a/src/optional.cpp b/src/optional.cpp
new file mode 100644
index 0000000..4678a76
--- /dev/null
+++ b/src/optional.cpp
@@ -0,0 +1,14 @@
+#include "optional.h"
+#include "common.h"
+#include "execsnoop.h"
+
+namespace CGPROXY::EXESNOOP {
+
+void *startThread(void *arg) {
+  thread_arg *p = (thread_arg *)arg;
+  callback = p->handle_pid;
+  execsnoop();
+  return (void *)0;
+}
+
+}
\ No newline at end of file
diff --git a/src/optional.h b/src/optional.h
new file mode 100644
index 0000000..8a16c32
--- /dev/null
+++ b/src/optional.h
@@ -0,0 +1,16 @@
+#ifndef OPTIONAL_H
+#define OPTIONAL_H 1
+
+#include <functional>
+using namespace std;
+
+namespace CGPROXY::EXESNOOP {
+
+struct thread_arg {
+  function<int(int)> handle_pid;
+};
+void *startThread(void *arg);
+
+}
+
+#endif
\ No newline at end of file