falco icon indicating copy to clipboard operation
falco copied to clipboard

Support multiple container runtime in one node

Open hitsub2 opened this issue 7 months ago • 3 comments

Motivation The bottlerocket OS has two containerd runtime with different sock file, one for k8s, one for host-containers(management), currently only the k8s containerd is monitored, but we need falco to monitor another containerd.

And also in some scenarios, like Docker in Docker, the CI pod would host another docker daemon for build purpose.

Feature Support multiple container runtime in one node.

Alternatives None.

Additional context

Bottlerocket uses host containers(exclude from the k8s containerd, called host-containerd) to run ssh server (admin-container) and aws ssm. And these host containers should be monitored because of all the privileges that host containers have can access the k8s pods.

hitsub2 avatar Jul 11 '24 01:07 hitsub2