search

martinpitt / fatrace

report system wide file access events
GNU General Public License v3.0
173 stars 12 forks source link

Error in docker container: Failed to add watch for /: Not supported #5

Closed bendavis78 closed 3 years ago

bendavis78 commented 3 years ago

I'm trying to run fatrace within a docker container. I'm able to run with --cap-add SYS_ADMIN, however I'm now getting the following error:

Failed to add watch for /: Not supported
martinpitt commented 3 years ago

The fanotify() API works rather poorly in a container (even a --privileged one). It definitively does not work on the root directory. The only thing you can do is fatrace --current-mount.

That's a limitation of the kernel, not fatrace.