Support bottlerocket

[faarshad]

Motivation
It will be useful to support bottlerocket-os which is a container focused distro from AWS.

Feature
Verify whether the vanilla target works for bottlerocket or not, and in such case document it.

Or, create a explicit target for bottlerocket.

Alternatives

Additional context

• Currently bottlerocket does not publish kernel.rpm or kernel-devel packages but they have Kernel Module Support: Publish kernel-devel & /proc/config.gz artifacts for each bottlerocket release bottlerocket-os/bottlerocket#1141 in their backlog
• See if its possible to recreate the logic in https://github.com/bottlerocket-os/bottlerocket/blob/d3096e86cf63f49294144a1f5d5d0cd7d3d56f92/packages/kernel/kernel.spec#L46-L58 and use the kernel-*.amzn2.src.rpm to build the falco kernel module
• Also note that with the introduction of multiple gcc versions in falco-driver loader, the dkms-way of building the kernel module on the fly works with falco-0.26+ on Bottlerocket-os-1.0.1. See Falco support bottlerocket-os/bottlerocket#862 (comment)

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[mike-stewart]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[mike-stewart]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[mike-stewart]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[mike-stewart]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[mike-stewart]

/remove-lifecycle stale

[arnaldo2792]

Hello folks,

I think you folks could close this issue, since we (the Bottlerocket team) tested both the falco kernel module and the eBPF probe, and we verified that both work just fine. Although we advice Bottlerocket users to use the eBPF probe instead of the kernel module, since some Bottlerocket images set the kernel lockdown value as integrity which will prevent containers from loading unsigned kernel modules.

We also have this guide that explains how to build a kernel module, and we used the falco kernel module in the example 👍 .

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[poiana]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

[FedeDP]

/close
as per comment ☝️

[poiana]

@FedeDP: Closing this issue.

In response to this:

/close
as per comment ☝️

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.