Patrick Dung

Sure, will submit a PR about it soon. I would like to test with Falco with Helm (on k3s) and the options you provided first. Then include it in the...

While I am testing Falco with k3s with helm, there are new problems: Falco could get the namespace/pod name of loghorn (it's in another NS). ``` 19:11:39.900830561: Notice Privileged container...

OK, I had created the PR because the location 'containerd.socket' has to be updated for K3S. The problem in https://github.com/falcosecurity/falco/issues/1911#issuecomment-1050206366 is another issue. Also, on second thought, the PR is...

@pabloopez It is basically the same as the original post that is used in the host, but it's in yaml format to be used when install by Helm. Here it...

Yes, it is the same pod (a container named goatcounter), it is inside K3S. In [this test](https://github.com/falcosecurity/falco/issues/1911#issuecomment-1050206366) when Falco is installed on host: ``` 16:10:51.023333426: Notice [16:10:51.023333426][9dc5e707f717] [goatcounter] ``` The...

@alfredomagallon Yes, I also test with --disable-cri-async flag with eBPF, the result is the same.

/remove-lifecycle stale

/remove-lifecycle rotten

@laymonage Yes 'pathname' solve the problem. Just now my web content provider cached and did not update my parameter and affect my testing. Hence, I would change the title to...

I was having server migration and lost the old setting. Besides that, I switched to use internal DB afterwards. So I do have have the environment to test it anymore...