container defenre inside google's distroless container

Showing results for 
Show  only  | Search instead for 
Did you mean: 

container defenre inside google's distroless container

L0 Member


I'm trying to run defender in fargate/sidecar mode. It works fin if I use alpine/ubuntu images as base, but It fails when I try to use google's distroless static/base images


The only log I get is


tandard_init_linux.go:190: exec user process caused "no such file or directory"


The  container works fine if I don't run the defender, so it seems not to be related to my binary


Any hint on how to fix this , if possible at all ?




update: it seems that the is the issue. I changed the entrypoint to use the defender command directly and it seems to work. However this way I will not have the sleeping loop, so I might end adding some workaround... 


Community Team Member

Thank you for the update !


Cheers !


LIVEcommunity team member, CISSP
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

L0 Member




I am having problems deploying the defender in a sidecar pattern using aws fargate eks. I get the /var/lib/twistlock/fargate/ logs Waiting for defender..., but the pod never gets registered to the console.


the setup I have is as below:


name: twistlockdefender
workingDir: /var/lib/twistlock/fargate/policy
command: ["/bin/sh", "-c"]
args: ["/var/lib/twistlock/fargate/ fargate & /usr/local/bin/defender "]
- name: twpolicy
mountPath: /var/lib/twistlock/fargate/policy

value: fargate


would appreciate an example of a deploy file which deploys an app and defender as a sidecar in same pod.









L4 Transporter

Greetings Zulkarnain,


I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.


Kind Regards,

J. Avery King

J. Avery King | Prisma Cloud | Customer Success Engineer

we are in the process of moving to a different solution before the license
expires, as it is not acceptable for us to introduce additional software
(sh and sleep) in our containers


Thanks for reaching out, can you share more details on you use case? also we offer app embedded defenders for situations a container defender cannot be used.


  • 5 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!