4 ms·
We have a Python application that we develop inside Docker on macOS using the `python:3.11-slim-bullseye` image that it would be great to generate scap files fr
by beaugunderson 2y ago
We have a Python application that we develop inside Docker on macOS using the `python:3.11-slim-bullseye` image that it would be great to generate scap files from for viewing with Stratoshark. I tried installing sysdig in that image but ran into kernel module errors when trying to run it. Should we expect that to work? Am I missing an easier method?
- geraldcombs 2y agoYou might try passing `--modern-bpf` to sysdig. It has traditionally captured syscalls using a kernel module, and it sounds like that's where your errors are coming from. Newer versions have added eBPF support, which doesn't require a kmod but you have to pass in the `--modern-bpf` flag.
- beaugunderson 2y agoAbsolutely nailed it, that worked! Thanks so much for the pointer.