chore(libsinsp/runc): report correct container id with short cid

Signed-off-by: Roberto Scolaro <[email protected]>
falcosecurity · Jan 16, 2025 · b0786f0 · b0786f0
1 parent 8e1b1a3
commit b0786f0
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/userspace/libsinsp/runc.cpp b/userspace/libsinsp/runc.cpp
@@ -72,11 +72,12 @@ bool match_one_container_id(const std::string &cgroup,
 		return false;
 	}
 
+	// Avoid system host cgroups.
 	if(cgroup.rfind("/default/") == 0 && !endswith(cgroup, ".service") &&
 	   !endswith(cgroup, ".slice")) {
 		size_t reported_len = end_pos - start_pos >= REPORTED_CONTAINER_ID_LENGTH
 		                              ? REPORTED_CONTAINER_ID_LENGTH
-		                              : end_pos;
+		                              : end_pos - start_pos;
 		container_id = cgroup.substr(start_pos, reported_len);
 		return true;
 	}