container defenre inside google's distroless container

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

container defenre inside google's distroless container

L0 Member

Hello,

I'm trying to run defender in fargate/sidecar mode. It works fin if I use alpine/ubuntu images as base, but It fails when I try to use google's distroless static/base images

 

The only log I get is

 

tandard_init_linux.go:190: exec user process caused "no such file or directory"

 

The  container works fine if I don't run the defender, so it seems not to be related to my binary

 

Any hint on how to fix this , if possible at all ?

 

thanks

 

update: it seems that the fargate_defender.sh is the issue. I changed the entrypoint to use the defender command directly and it seems to work. However this way I will not have the sleeping loop, so I might end adding some workaround... 

5 REPLIES 5

Community Team Member

Thank you for the update !

 

Cheers !

-Kiwi.

 
LIVEcommunity team member, CISSP
Cheers,
Kiwi
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

L0 Member

  

 
 
 
 

 

I am having problems deploying the defender in a sidecar pattern using aws fargate eks. I get the /var/lib/twistlock/fargate/fargate_defender.sh logs Waiting for defender..., but the pod never gets registered to the console.

 

the setup I have is as below:

 

image: registry-auth.twistlock.com/tw_qbwexdrqucvju1oewzidiwvg1tjqybuk/twistlock/defender:defender_20_12_541
name: twistlockdefender
workingDir: /var/lib/twistlock/fargate/policy
command: ["/bin/sh", "-c"]
args: ["/var/lib/twistlock/fargate/fargate_defender.sh fargate & /usr/local/bin/defender "]
volumeMounts:
- name: twpolicy
mountPath: /var/lib/twistlock/fargate/policy

- name: DEFENDER_TYPE
value: fargate

 

would appreciate an example of a deploy file which deploys an app and defender as a sidecar in same pod.

 

Thanks

Zul

 

 

 

 

 

L4 Transporter

Greetings Zulkarnain,

 

I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.

 

Kind Regards,

J. Avery King

J. Avery King | Prisma Cloud | Customer Success Engineer

Hello,
we are in the process of moving to a different solution before the license
expires, as it is not acceptable for us to introduce additional software
(sh and sleep) in our containers

Giulianoz,

Thanks for reaching out, can you share more details on you use case? also we offer app embedded defenders for situations a container defender cannot be used.

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/install_def...

 

  • 4724 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!