File tree Expand file tree Collapse file tree 1 file changed +6
-1
lines changed
plugins/container/src/caps/parse Expand file tree Collapse file tree 1 file changed +6
-1
lines changed Original file line number Diff line number Diff line change @@ -177,7 +177,9 @@ bool my_plugin::parse_exit_process_event(
177177 std::string container_id;
178178
179179 // retrieve the thread entry associated with this thread id,
180- // then, fetch the container_id and remove it from the container cache.
180+ // check if vpid is 1, so if this is an init process,
181+ // then, fetch the container_id and if not empty,
182+ // remove its associated entry from the container cache.
181183 try
182184 {
183185 auto thread_entry = m_threads_table.get_entry (tr, thread_id);
@@ -187,6 +189,9 @@ bool my_plugin::parse_exit_process_event(
187189 m_container_id_field.read_value (tr, thread_entry, container_id);
188190 if (!container_id.empty ())
189191 {
192+ m_logger.log (fmt::format (" Removing container from procexit: {}" ,
193+ container_id),
194+ falcosecurity::_internal::SS_PLUGIN_LOG_SEV_TRACE);
190195 m_containers.erase (container_id);
191196 }
192197 }
You can’t perform that action at this time.
0 commit comments