aws-guardduty-agent EKS add-on not working

[imranismail]

I'm trying to enable guardduty eks runtime monitoring but I am having problem installing the agent and facing this error:

apiVersion: v1
kind: Pod
metadata:
...
  containerStatuses:
    - name: aws-guardduty-agent
      state:
        waiting:
          reason: RunContainerError
          message: >-
            failed to create containerd task: failed to create shim task: OCI
            runtime create failed: runc create failed: unable to start container
            process: can't set process label: open /proc/thread-self/attr/exec:
            read-only file system: unknown
      lastState:
        terminated:
          exitCode: 128
          reason: StartError
          message: >-
            failed to create containerd task: failed to create shim task: OCI
            runtime create failed: runc create failed: unable to start container
            process: can't set process label: open /proc/thread-self/attr/exec:
            read-only file system: unknown
          startedAt: '1970-01-01T00:00:00Z'
          finishedAt: '2023-05-19T09:09:35Z'
          containerID: >-
            containerd://de0d4689b22550fc655e3de0b4c95b509b3a096e81c90ba04340a993b2f1b5a3
      ...

[stmcginnis]

Hey @imranismail - from what I understand, GuardDuty does not currently support Bottlerocket. I believe that team is working on adding support, but I don't have an ETA for you. I'll try to remember to come back to this if I hear any more, but watch for any announcements coming from GuardDuty on availability.

[imranismail]

I see, that's unfortunate. I'll switch back to Falco in the meantime.

[yaroslav-nakonechnikov]

this one fixed now.
guard duty now works