TRC-11 triggered from runc process

[rafaeldtinoco]

and related discussion:

[roikol]

i think the easy aaproach which is also good is to check whether its the runc process, with tid == 1. if it is the case - do not trigger.

the other approach is to create an event of container_start, and only trigger after the container started. in this case, this signature should be rewritten to go, as it becomes statefull (need to keep track of started containers).

@rafaeldtinoco @yanivagman any thoughts?

[rafaeldtinoco]

With the change we made, we have already probably got rid of most of the false positives. There is still a catch from Yaniv's comment that we could address, thus the reason for me to re-open this (but with less priority now).

[yanivagman]

We now have the container_started flag which can be used in this rule to distinguish runc processes. @roikol @AsafEitani I think all existing rules should be revisted and use this flag instead of excluding the runc process