container defenre inside google's distroless container

[giulianoz]

Hello,

I'm trying to run defender in fargate/sidecar mode. It works fin if I use alpine/ubuntu images as base, but It fails when I try to use google's distroless static/base images

The only log I get is

tandard_init_linux.go:190: exec user process caused "no such file or directory"

The  container works fine if I don't run the defender, so it seems not to be related to my binary

Any hint on how to fix this , if possible at all ?

thanks

update: it seems that the fargate_defender.sh is the issue. I changed the entrypoint to use the defender command directly and it seems to work. However this way I will not have the sleeping loop, so I might end adding some workaround... 

[kiwi]

Thank you for the update !

Cheers !

-Kiwi.

[Zulkarnain]

Hello Giulianoz,

I am having problems deploying the defender in a sidecar pattern using aws fargate eks. I get the /var/lib/twistlock/fargate/fargate_defender.sh logs Waiting for defender..., but the pod never gets registered to the console.

the setup I have is as below:

image: registry-auth.twistlock.com/tw_qbwexdrqucvju1oewzidiwvg1tjqybuk/twistlock/defender:defender_20_12_541
name: twistlockdefender
workingDir: /var/lib/twistlock/fargate/policy
command: ["/bin/sh", "-c"]
args: ["/var/lib/twistlock/fargate/fargate_defender.sh fargate & /usr/local/bin/defender "]
volumeMounts:
- name: twpolicy
mountPath: /var/lib/twistlock/fargate/policy

- name: DEFENDER_TYPE
value: fargate

would appreciate an example of a deploy file which deploys an app and defender as a sidecar in same pod.

Thanks

Zul

[AKing9]

Greetings Zulkarnain,

I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.

Kind Regards,

J. Avery King

[giulianoz]

Hello,
we are in the process of moving to a different solution before the license
expires, as it is not acceptable for us to introduce additional software
(sh and sleep) in our containers

[MDavis29]

Giulianoz,

Thanks for reaching out, can you share more details on you use case? also we offer app embedded defenders for situations a container defender cannot be used.

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/install_def...