Describe the bug

When settings collectors.containerd.socket=/run/k3s/containerd/containerd.sock, the socket is mounted at the wrong place, causing <NA> on kubernetes fields.

How to reproduce it

1. helm template falco falcosecurity/falco --version 4.20.0 --set collectors.containerd.socket=/run/k3s/containerd/containerd.sock

2. Configmap shows:

   # Source: falco/templates/configmap.yaml
   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: falco
     # ...
   data:
     falco.yaml: |-
       # ...
       cri:
         enabled: true
         sockets:
         - /run/k3s/containerd/containerd.sock # <---
       # ...

3. But the socket is mounted at /run/containerd. See DaemonSet:

   # Source: falco/templates/daemonset.yaml
   apiVersion: apps/v1
   kind: DaemonSet
   metadata:
     name: falco
     # ...
   spec:
     # ...
     template:
       # ...
       spec:
         # ...
         containers:
           - name: falco
             # ...
             env:
               - name: HOST_ROOT
                 value: /host
             volumeMounts:
               - mountPath: /host/run/containerd/ # <---
                 name: containerd-socket
               # ...
             # ...
         volumes:
           - name: containerd-socket
             hostPath:
               path: /run/k3s/containerd
         # ...

Expected behaviour

Either, in falco.yaml, .cri.sockets should be set to /run/containerd/containerd.sock, or the socket directory should be mounted at /host/run/k3s/containerd/.

I'm using this as a workaround for now:

# charts/falco/templates/pod-template.tpl
@@ -175,7 +175,7 @@ spec:
           name: docker-socket
         {{- end }}
         {{- if .containerd.enabled }}
-        - mountPath: /host/run/containerd/
+        - mountPath: /host{{ dir .containerd.socket }}
           name: containerd-socket
         {{- end }}
         {{- if .crio.enabled }}

Screenshots

Before patching the configmap:

2025-02-09T02:20:01.307755967+0000: Notice Redirect stdout/stdin to network connection (gparent=containerd-shim ggparent=systemd gggparent=<NA> fd.sip=<NA> connection= lport=<NA> rport=<NA> fd_type=ipv4 fd_proto=raw evt_type=dup3 user=root user_uid=0 user_loginuid=-1 process=ping proc_exepath=/bin/busybox parent=ash command=ping -c 1 -W 5 192.168.0.61 terminal=0 container_id=cf342f90f2de container_image=<NA> container_image_tag=<NA> container_name=<NA> k8s_ns=<NA> k8s_pod_name=<NA>)

After patching the configmap manually by setting /run/containerd/containerd.sock in cri.sockets:

2025-02-09T03:00:02.834600255+0000: Notice Redirect stdout/stdin to network connection (gparent=containerd-shim ggparent=systemd gggparent=<NA> fd.sip=<NA> connection= lport=<NA> rport=<NA> fd_type=ipv4 fd_proto=raw evt_type=dup3 user=root user_uid=0 user_loginuid=-1 process=ping proc_exepath=/bin/busybox parent=ash command=ping -c 1 -W 5 192.168.0.61 terminal=0 container_id=7933d14dc3ad container_image=docker.io/alpine/curl container_image_tag=8.11.1 container_name=ping-check k8s_ns=default k8s_pod_name=ping-check-28984500-h6nkq)

Environment

• Falco version: 0.40.0
• System info:

{"machine":"aarch64","nodename":"falco-drgrq","release":"6.6.62+rpt-rpi-v8","sysname":"Linux","version":"#1 SMP PREEMPT Debian 1:6.6.62-1+rpt1 (2024-11-25)"}

• Cloud provider or hardware configuration: Raspberry Pi 4 with k3s
• OS: Debian 12
• Kernel: 6.6.62+rpt-rpi-v8
• Installation method: Helm