Error: failed to generate container "***" spec: failed to generate spec: no command specified

[mugambika]

Trying to install Falcosidekick on rke2 version 1.24.9+rke2r2. We are observing the following errors:
Falcosidekick:
Error: failed to generate container "***" spec: failed to generate spec: no command specified

Falcosidekick-ui:
Error: failed to create containerd task: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: "-r": executable file not found in $PATH: unknown

Container is unable to find command ./falcosidekick to run.
If falcosidekick deployment is updated with command: ["./falcosidekick"], the pod comes to running state.

How to reproduce it

Install falcosidekick using helm.

Chart version - 0.6.1
Falcosidekick version - 2.27.0
Falcosidekick-ui version - 2.1.0

kubectl get po -n falcosidekick
NAME READY STATUS RESTARTS AGE
falcosidekick-7c996586cb-g2g9j 0/1 CreateContainerError 0 23s
falcosidekick-7c996586cb-vxf9g 0/1 CreateContainerError 0 23s
falcosidekick-ui-5776f5b6c9-ng22h 0/1 CrashLoopBackOff 1 (17s ago) 23s
falcosidekick-ui-5776f5b6c9-xl9v2 0/1 CrashLoopBackOff 1 (14s ago) 23s

Expected behaviour

All pods should be running state.

Screenshots

Environment

• Falco version:
  0.30.0
• System info:
  system_info":{"machine":"x86_64","nodename":"tesh0m000006","release":"5.3.18-150300.59.101-default","sysname":"Linux","version":"fix: install ca-certificates #1 SMP Tue Nov 1 11:32:03 UTC 2022 (b2a976e)"},"version":"0.30.0"}
• Cloud provider or hardware configuration:
• OS:
  NAME="SLES"
  VERSION="15-SP3"
  VERSION_ID="15.3"
  PRETTY_NAME="SUSE Linux Enterprise Server 15 SP3"
  ID="sles"
  ID_LIKE="suse"
  ANSI_COLOR="0;32"
  CPE_NAME="cpe:/o:suse:sles:15:sp3"
  DOCUMENTATION_URL="https://documentation.suse.com/"
• Kernel:
  Linux tesh0m000006 5.3.18-150300.59.101-default fix: install ca-certificates #1 SMP Tue Nov 1 11:32:03 UTC 2022 (b2a976e) x86_64 x86_64 x86_64 GNU/Linux
• Installation method:
  RPM - https://download.falco.org/

Additional context

[Issif]

What are your install command and values?

[mugambika]

helm install falcosidekick falcosidekick/falcosidekick --values values.yaml -n falcosidekick

Values.yaml

replicaCount: 2

image:
  registry: <internal registry>
  repository: falcosecurity/falcosidekick
  tag: 2.26.0
  pullPolicy: Always

podSecurityContext:
  runAsUser: 1234
  fsGroup: 1234

securityContext:
  capabilities:
    drop:
    - ALL
  runAsNonRoot: true
  runAsUser: 1000

service:
  type: ClusterIP
  port: 2801
  annotations: {}
resources:
  limits:
    cpu: 100m
    memory: 128Mi
  requests:
    cpu: 100m
    memory: 128Mi

webui:
  # -- enable Falcosidekick-UI
  enabled: true
  replicaCount: 2
  loglevel: "info"
  ttl: 0
  user: "admin:admin"
  allowcors: false
  image:
    registry: <internal registry>
    repository: falcosecurity/falcosidekick-ui
    tag: "2.0.1"
    pullPolicy: Always

  podSecurityContext:
    runAsUser: 1234
    fsGroup: 1234

  securityContext:
    capabilities:
      drop:
      - ALL
    runAsNonRoot: true
    runAsUser: 1000

  service:
    type: ClusterIP
    port: 2802
    nodePort: 30282
    targetPort: 2802
    annotations: {}

  ingress:
    enabled: true
    hosts:
      - host: <host>
        paths:
        - path: /ui
          pathType: Prefix
        - path: /events
          pathType: Prefix
        - path: /healthz
          pathType: Prefix
        - path: /ws
          pathType: Prefix
  tls:
    - secretName: tls-sidekick-ui-ingress
      hosts:
        - <host>

redis:
    enabled: false

[Issif]

I see in your values you're trying to run an old version of falcosidekick-ui, it that in purpose? if true, then the tag should be v2.0.1.

[mugambika]

I was testing with different versions of it. I faced the same issue with v2.1.0 as well. We use private registry, I missed the v while tagging.

[Issif]

For the v2.1.0 you need to change more, update falcosidekick to 2.27.0 and replace the paths for the ingress to / only, and enable the redis

[mugambika]

Same errors after deploying with above image versions as well.

[Issif]

How have you created the images in your private registry?

[mugambika]

Yes, Used images from the following links.
https://github.com/falcosecurity/falcosidekick/releases/download/2.27.0/falcosidekick_2.27.0_linux_amd64.tar.gz
https://github.com/falcosecurity/falcosidekick-ui/releases/download/v2.1.0/falcosidekick-ui_2.1.0_linux_amd64.tar.gz

[Issif]

These links are for the binaries not the images. If you want to build the image in your CI and push it into your repo, you should use this Dockerfile.

[mugambika]

My bad, I did a blunder. I used incorrect images. Thanks for pointing out.

[Issif]

Is it good now?

[mugambika]

Yes It is working with the images.

[Issif]

Thanks.