Melissa Kilby

Installed `cri-dockerd` real quick and used `crictl` to spin up a pod, and it's confirmed it does categorize it as docker ... ``` $ sudo crictl run container-config.json pod-config.json [22:16:09]...

@networkhell opened a WIP PR. The issue was that the cgroups layout for docker was not supported for our internal CRI container engine. However right now we would do lookups...

Thanks for the additional info. I believe we should support cri docker, because we also support docker and who knows maybe it becomes more relevant in the future. Just need...

@leogr I believe exposing container engines configs in `falco.yaml` can not only help here, but also make the configuration more versatile. For example, I never liked that all container engines...

I may like option 3, it seems shorter. yes let me open a dedicated issue.

/milestone 0.39.0

@networkhell Once (1) https://github.com/falcosecurity/libs/pull/1907 and (2) https://github.com/falcosecurity/falco/pull/3266 are merged you could test the master falco container with the folllowing config. Important would be to disable docker. ``` container_engines: docker: enabled:...

I believe we need to bump libs in falco first. We will ping you here when we do it the next time.

Hi @ldegio we are having similar asks for example here https://github.com/falcosecurity/libs/issues/1981#issuecomment-2275020805. I would personally prefer expanding the new planned `.join` https://github.com/falcosecurity/libs/issues/1925 (or a different name) operator, so that we don't...

Hey 👋, happy to join the discussion. `proc.name` certainly can not and should never be called exe name or executable name (besides it's mostly cropped at 16 characters depending on...