falcosecurity / libs

libsinsp, libscap, the kernel module driver, and the eBPF driver sources
https://falcosecurity.github.io/libs/
Apache License 2.0
223 stars 163 forks source link

[TRACKING] Improve container engine state handling #1708

Open incertum opened 6 months ago

incertum commented 6 months ago

Motivation

We have identified a few areas of improvements wrt to state handling during the container lookup cycle, see https://github.com/falcosecurity/libs/pull/1595#discussion_r1502988032.

This issue serves to track progress in this regard.

It is also related to https://github.com/falcosecurity/libs/issues/291.

@gnosek @therealbobo @mstemm @leogr

incertum commented 6 months ago

Please also explore https://github.com/falcosecurity/libs/pull/1707: It's incorrect to initialize a lookup to SUCCESSFUL, by the way. I believe this is the strongest indication of a very suboptimal shared design across the container engines we support.

poiana commented 3 months ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

incertum commented 3 months ago

/remove-lifecycle stale

Will get back to it soon.

poiana commented 2 weeks ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

leogr commented 2 weeks ago

/remove-lifecycle stale

incertum commented 2 weeks ago

We didn't get to this for libs 0.18. We need a lot more time to improve this as it will also need lots of testing.

We can try libs 0.19 or the following dev cycle.

FedeDP commented 2 weeks ago

Agree! /milestone 0.19.0