fix(userspace/libsinsp): not report container id as host on failed lo…

…okups Signed-off-by: Jason Dellaluce <[email protected]>
falcosecurity · Dec 22, 2023 · 2d6ccce · 2d6ccce
1 parent e9333d9
commit 2d6ccce
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/userspace/libsinsp/sinsp_filtercheck_container.cpp b/userspace/libsinsp/sinsp_filtercheck_container.cpp
@@ -179,12 +179,11 @@ uint8_t* sinsp_filter_check_container::extract(sinsp_evt *evt, OUT uint32_t* len
 	}
 
 	sinsp_container_info::ptr_t container_info = NULL;
-	bool is_host = true;
+	bool is_host = tinfo->m_container_id.empty() && !tinfo->is_in_pid_namespace();
 
 	if(!tinfo->m_container_id.empty())
 	{
-		is_host = false;
-		container_info = m_inspector->m_container_manager.get_container(tinfo->m_container_id);
+		container_info = m_inspector->m_container_manager.get_container(tinfo->m_container_id);	
 	}
 
 	switch(m_field_id)