Skip to content

Update system-probe seccomp profile to fix container creation issue on OpenShift#2719

Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 1 commit intomainfrom
lenaic/fix_sysprobe_seccomp_openshift
Mar 9, 2026
Merged

Update system-probe seccomp profile to fix container creation issue on OpenShift#2719
gh-worker-dd-mergequeue-cf854d[bot] merged 1 commit intomainfrom
lenaic/fix_sysprobe_seccomp_openshift

Conversation

@L3n41c
Copy link
Member

@L3n41c L3n41c commented Mar 9, 2026

What does this PR do?

Adds setresgid and setresuid syscalls to system-probe seccomp profile.

Motivation

On the latest version of OpenShift, deploying the datadog-agent leaves the node agents in the CreateContainerError state forever with the following error:

$ kubectl --namespace datadog-agent-helm get pods
NAME                                                     READY   STATUS                 RESTARTS   AGE
[…]
pod/datadog-agent-linux-pc5mh                            4/5     CreateContainerError   0          26m
$ kubectl --namespace datadog-agent-helm describe pod/datadog-agent-linux-pc5mh
[…]
Events:
  Type     Reason     Age                From               Message
  ----     ------     ----               ----               -------
[…]
  Warning  Failed     8s (x8 over 50s)   kubelet            Error: container create failed: setresuid to `0`: Operation not permitted

Additional Notes

Corresponding PR on the Helm chart: DataDog/helm-charts#2442

Minimum Agent Versions

Are there minimum versions of the Datadog Agent and/or Cluster Agent required?

  • Agent: vX.Y.Z
  • Cluster Agent: vX.Y.Z

Describe your test plan

Write there any instructions and details you may have to test your PR.

Checklist

  • PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
  • PR has a milestone or the qa/skip-qa label
  • All commits are signed (see: signing commits)

@L3n41c L3n41c added this to the v1.25.0 milestone Mar 9, 2026
@L3n41c L3n41c added the enhancement New feature or request label Mar 9, 2026
@L3n41c L3n41c requested a review from a team March 9, 2026 09:41
@L3n41c L3n41c requested a review from a team as a code owner March 9, 2026 09:41
@codecov-commenter
Copy link

codecov-commenter commented Mar 9, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38.77%. Comparing base (0b27d7c) to head (dde930b).

Additional details and impacted files

Impacted file tree graph

@@           Coverage Diff           @@
##             main    #2719   +/-   ##
=======================================
  Coverage   38.77%   38.77%           
=======================================
  Files         308      308           
  Lines       26706    26708    +2     
=======================================
+ Hits        10354    10356    +2     
  Misses      15572    15572           
  Partials      780      780           
Flag Coverage Δ
unittests 38.77% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
...controller/datadogagent/component/agent/default.go 44.96% <100.00%> (+0.16%) ⬆️

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0b27d7c...dde930b. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@gh-worker-dd-mergequeue-cf854d gh-worker-dd-mergequeue-cf854d bot merged commit a2fb04f into main Mar 9, 2026
58 checks passed
@gh-worker-dd-mergequeue-cf854d gh-worker-dd-mergequeue-cf854d bot deleted the lenaic/fix_sysprobe_seccomp_openshift branch March 9, 2026 16:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants