Conversation
biscout42
changed the title
Tacklebox
reviewed
Aug 20, 2026
Tacklebox
left a comment
Tacklebox
left a comment
Contributor
There was a problem hiding this comment.
I'm not sure it makes sense to write rules based on container.id outside of the special case of LXC, since the ids won't be known at the time when the policy is written since they are generated at runtime right? I don't see any technical issues with the PR though.
christos68k
previously approved these changes
Aug 20, 2026
biscout42
marked this pull request as draft
August 21, 2026 13:30
Contributor
Author
|
I'll update this logic when #395 is done. |
biscout42
commented
Aug 24, 2026
Contributor
Author
|
@Tacklebox , the use case here is to separate container events for k8s vs host events. |
biscout42
force-pushed
the
feat-container-event-scope
branch
from
September 16, 2026 11:38
71a6c42 to
bee3016
Compare
biscout42
force-pushed
the
feat-container-event-scope
branch
from
September 16, 2026 12:12
bee3016 to
912c965
Compare
biscout42
force-pushed
the
feat-container-event-scope
branch
from
September 16, 2026 12:49
912c965 to
4be0a32
Compare
biscout42
force-pushed
the
feat-container-event-scope
branch
2 times, most recently
from
September 16, 2026 13:58
0f47f2c to
f862add
Compare
biscout42
force-pushed
the
feat-container-event-scope
branch
from
September 16, 2026 14:34
f862add to
3462c37
Compare
biscout42
force-pushed
the
feat-container-event-scope
branch
2 times, most recently
from
September 16, 2026 18:29
571ead4 to
8b39587
Compare
biscout42
marked this pull request as ready for review
September 17, 2026 10:08
christos68k
previously approved these changes
Sep 18, 2026
christos68k
left a comment
christos68k
left a comment
Member
There was a problem hiding this comment.
Left some documentation nits for clarity.
LGTM
biscout42
force-pushed
the
feat-container-event-scope
branch
from
September 21, 2026 08:32
2232936 to
74c480a
Compare
christos68k
previously approved these changes
Sep 21, 2026
biscout42
force-pushed
the
feat-container-event-scope
branch
from
September 23, 2026 12:42
74c480a to
75695b1
Compare
biscout42
force-pushed
the
feat-container-event-scope
branch
2 times, most recently
from
September 25, 2026 08:29
98b200e to
0f62fa1
Compare
process_set_cgroup keeps the cached container ID when the new cgroup does not name a container. The test moved a container process to a host cgroup and expected the host rule to match. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
process_container_id never returns an empty string, so drop the empty-string checks. The kprobe backend does not report the cgroup of new processes, note this in the man page and CHANGES. Move the CHANGES entry to the end of the 0.8 section to follow the file order. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The host rule matched every process without a container ID, including processes with no cgroup at all. On the kprobe backend, and for eBPF processes first seen through setsid, setuid or setgid, the cgroup is unknown, so container events matched the host rule. Match neither scope when the cgroup is unknown or not yet parsed. Document that only the last cgroup component is parsed and that nested cgroups match host. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
biscout42
force-pushed
the
feat-container-event-scope
branch
from
September 25, 2026 17:17
0f62fa1 to
f1ba260
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The change allows to filter host events vs container events.