3 ms·
Would this be useful in a containerized architecture where everything is run as a container?
by aliakhtar 10y ago
Would this be useful in a containerized architecture where everything is run as a container?
- viraptor 10y agoAt the host level - yes. All the applications still make the same requests to the kernel. Different namespace doesn't matter.
- rkv 10y agoI'd argue no. While you still receive all the syscalls that are made within each container, there is no way to differentiate those calls from ones made directly on the host. So no filtering or analytics can be made for containers. This is a known issue of the audit framework in Linux.