Christian Bianchi

We found out what's causing the issue, if it might spark an idea on your end. There was an error in the Kubernetes Pod Spec, and the container failed creating...

I also failed reproducing it with plain docker. Also not sure the lock on the log file is actually the real problem here. Will update if I have new info

I have been able to get the bull byte error using the docker client library: ``` package main import ( "context" "github.com/docker/docker/api/types/container" "github.com/docker/docker/api/types/network" "github.com/docker/docker/client" v1 "github.com/opencontainers/image-spec/specs-go/v1" ) func main() {...

> And could you verify whether the issue also happens when a fresh VM is provisioned with 3227.2.0? Or does it require updating. Not 100% sure I have the same...

> Hey @whites11 > > have you tried disabling Syslog output and logging from Falco? > > If you're using helm, try: `--set falco.log_syslog=false --set falco.syslog_output.enabled=false` I did, but unfortunately...

I started from a vanilla flatcar, installed k8s on top of it using [this](https://suraj.io/post/2021/01/kubeadm-flatcar/), then run falco through the helm chart. Unfortunately I still can't replicate the issue. In any...

> I'm also curious about what caused the issue smile_cat I think I understood something more. The issue happens when falco is running and our custom auditd rules are in...

I found out that if I disabled kubelet from the node, journald didn't crash. So I tried disable the pods one by one until I found the offending one. I...

We verified that this happens with upstream falco chart as well, without any modification. ``` helm repo add falcosecurity https://falcosecurity.github.io/charts helm repo update helm install falco falcosecurity/falco --namespace falco --create-namespace...

I started from a vanilla flatcar, installed k8s on top of it using [this](https://suraj.io/post/2021/01/kubeadm-flatcar/), then run falco through the helm chart. Unfortunately I still can't replicate the issue. @jepio If...