Container Engine Refactor (CRI)

[incertum]

Continue improvement suggestions from #1550

Prerequisites: More unit and e2e tests, especially also around cgroups.

Details to be added later.

Related:

• [PROPOSAL] Formalize container engine testing framework similar to the new kernel version testing framework #1298
• wip: feat/new(libsinsp): operationalize container exit events for compliance use cases #1228
• [TRACKING] Re-audit container engines for empty container info values (Initial focus on CRI for Kubernetes) falco#2708
• No support for Podman container activity capturing by container.id #1115

@leogr @Andreagit97 @gnosek

[incertum]

/milestone 0.15.0

/assign

but it won't be just one PR or one person working on it, a collaborative effort is needed

[FedeDP]

The effort will continue during the next release.
/milestone 0.17.0

[FedeDP]

The effort is still going on right? @incertum
/milestone 0.18.0

[incertum]

Yes. So far we cleaned the API up, but we still need to improve the robustness and self-healing mechanisms if possible. I'll post more starting in 2 weeks ...

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[FedeDP]

/remove-lifecycle stale

[LucaGuerra]

/milestone 0.19.0

Some incremental progress has been done here but container engines can still need some work

[FedeDP]

/milestone 0.20.0

[FedeDP]

Considering falcosecurity/falco#3403, i think we can close this one. (i mean, no big effort/refactor/cleanup will be made on that area of sinsp since we are moving away from it).

/close

(Feel free to reopen if you feel this is still valuable!)

[poiana]

@FedeDP: Closing this issue.

In response to this:

Considering falcosecurity/falco#3403, i think we can close this one. (i mean, no big effort/refactor/cleanup will be made on that area of sinsp since we are moving away from it).

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.