fix(libsinsp/runc): augument containerd filter

Signed-off-by: Roberto Scolaro <[email protected]>
falcosecurity · Jan 20, 2025 · e531ed7 · e531ed7
1 parent ce530b5
commit e531ed7
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/userspace/libsinsp/runc.cpp b/userspace/libsinsp/runc.cpp
@@ -74,7 +74,7 @@ bool match_one_container_id(const std::string &cgroup,
 
 	// Avoid system host cgroups.
 	if(cgroup.rfind("/default/") == 0 && !endswith(cgroup, ".service") &&
-	   !endswith(cgroup, ".slice")) {
+	   !endswith(cgroup, ".slice") && endswith(cgroup, ".scope")) {
 		size_t reported_len = end_pos - start_pos >= REPORTED_CONTAINER_ID_LENGTH
 		                              ? REPORTED_CONTAINER_ID_LENGTH
 		                              : end_pos - start_pos;