Cortex XDR agent installation suggestions for a Proxmox host and its LXC containers

[rmavrinac]

We use a cluster of Proxmox servers which host a number of LXC containers and KVM/QEMU VMs. Our central IT department requires use to install the Cortex XDR agent on all the devices. I have a Debian Bookworm server with the cortex agent installed which only consumes between 0.0-0.3% CPU. On the Proxmox servers, this CPU usage is about 140%. Making things worse, each LXC container shares the host's kernel and for every pmd process in hosted LXC containers these processes show up on the Proxmox server host as additional pmd processes also running at 140% CPU usage.

I see plenty of documentation about Docker/Kubernetes and VM templates, but none of it applies to Linix containers.

Any suggestions as to how to get this to behave?

[anlynch]

Hi @rmavrinac,

Thanks for reaching out to LIVEcommunity!

I'm sorry to hear about the problem that you're running into.  First, I don't believe the Cortex XDR Agent is going to run properly in a ProxMox LXC Container.  Please see here for our documentation regarding where a Cortex XDR Agent can be installed.

In regards to your issues of CPU usage I'd recommend reaching out to Customer Support.  You'll have the ability to send them a support file and they'll be able to give you more help on how to resolve this issue if possible.  

I hope you found this information helpful.

Have a great day!

[rmavrinac]

Thanks for your comments.

Regardless of how the agent will run in the LXC container, the host server itself is experiencing the high CPU load. We'll open a ticket for that specifically.

Our security group is insisting on having the cortex agent installed on every server - unfortunately we have a number of servers running as containers. Since the LXC container processes are just isolated by namespace while sharing the host kernel, and the host sees all these processes anyhow, I agree that the agent probably shouldn't be running in an LXC container at all.