exein-io / pulsar

A modular and blazing fast runtime security tool for the IoT, powered by eBPF.
https://pulsar.sh
Other
905 stars 51 forks source link

fix: Handle libpod rootless containers, use sqlite as the source of info #237

Closed vadorovsky closed 9 months ago

vadorovsky commented 10 months ago

Before this change, we were using podman inspect command to get information about libpod containers. But since Pulsar is running as root, using CLI is not going to show any information about rootless containers.

This is fixed by using sqlite (which is used internally by libpod) and images.json file to resolve all necessary information about containers. To handle rootless containers gracefully, we check whether any user with their own home directory has a libpod database.