chore(containers): make feature flag a safe guard

[rafaeldtinoco]

commit b39d884 (HEAD -> no-containers-default, rafaeldtinoco/no-containers-default)
Author: Rafael David Tinoco [email protected]
Date: Wed Oct 25 12:09:09 2023

fix(definitions): debug shows wrong logs for sig events

commit b067fd3
Author: Rafael David Tinoco [email protected]
Date: Wed Oct 25 11:51:14 2023

chore(containers): make feature flag a safe guard

- make default behavior (--containers) to enrich containers
- keep a safeguard measure (change cmdline flag to --no-containers)

[geyslan]

LGTM

[geyslan]

I've did a bisect and detected that this raised these error logs:

{"level":"error","ts":1698260772.5729601,"msg":"error triggering container enrich in control plane","error":"containers.(*Containers).EnrichCgroupInfo: containers.(*runtimeInfoService).getFromKnownRuntime: unsupported runtime"}

https://github.com/aquasecurity/tracee/actions/runs/6644853997/job/18055080048?pr=3610#step:4:400

{"level":"error","ts":1698260853.4470563,"msg":"error triggering container enrich in control plane","error":"containers.(*Containers).EnrichCgroupInfo: containers.(*runtimeInfoService).getFromKnownRuntime: unsupported runtime"}

https://github.com/aquasecurity/tracee/actions/runs/6644853997/job/18055080048?pr=3610#step:4:452

Was it a dormant bug that came to the surface? Or are those errors expected?

[rafaeldtinoco]

Was it a dormant bug that came to the surface? Or are those errors expected?

container enriching is default now. likely a test trying to run enriching and facing issues because this wasn't done before. there is a flag to disable enriching that could bet set for the runtime tests, I believe (until test is ready for the enriching ?).

[geyslan]

Yep. Agree. Disabling it on integration tests.