Skip to content

Conversation

@ekoops
Copy link
Contributor

@ekoops ekoops commented Dec 18, 2025

This PR fixes some issues introduced with #108, and some other due to the need of rebuilding images. Specifically:

  • it fixes some issues with AWS headers installation in ubuntu images
  • it fixes some clang-related issues by pinning the modernprobe-builder base image to fedora:39

It introduces some temporary mitigations:

  • disable legacy BPF tests on oraclelinux-5.15-aarch64 and oraclelinux-5.4-x86_64.
  • it pins version v0.3.2 for ubuntu-6.5-aarch64

For all aforementioned points, please see commits log messages.

Besides this, it modifies arch/distro/kern Makefile targets behaviour to tag generated images and cleans up some Dockerfiles.
Finally, it reintroduces oraclelinux-3.10 machine, as I conducted some tests and it seems to work now.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
The current installation method for AWS linux headers and tools is
based on downloading them from `ports.ubuntu.com` or
`archive.ubuntu.com`, and then installing them with `dpkg -i`.
Unfortunately, the current implementation doesn't work, because
AWS headers are split into two packages: for example, headers for
kernel `6.5.0-1024-aws` are split into
`linux-headers-6.5.0-1024-aws` and
`linux-aws-6.5-headers-6.5.0-1024`; both must be installed in order
for anything using headers to work. Fix this headers and tools
using directly the package manager.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Pin `modernprobe-builder` base image to`fedora:39`. Fedora 39 is
deprecated, but this ensures working BPF object files build to run our
distro/kernel tests. In the future, we can upgrade this after we
investigate more the issues related to modern `clang` versions.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
@ekoops ekoops changed the title Ekoops/fix images fix: fix ubuntu AWS headers and downgrade modernprobe-builder base image Dec 18, 2025
@ekoops
Copy link
Contributor Author

ekoops commented Dec 18, 2025

/hold until CI is green

Disable BPF tests for both `oraclelinux-5.4-x86_64` and
`oraclelinux-5.15-aarch64`. The VMs rootfs are based on
`oraclelinux:8` and `oraclelinux:9`, which unfortunately provide a too
much recent clang version (clang 20). This version doesn't work well
wil the kernel expectation, and results in failing legacy BPF tests.

BPF tests are disabled through a new `skip_legacy_bpf_tests` property
in machine specification (see
`ansible-playbooks/group_vars/all/vars.yml`). The new mechanism works
by disabling legacy BPF support if the property is defined and set to
true.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
I conducted some tests and this machine seems to correctly work.
Reintroduce it.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
This is a temporary solution to make ubuntu-6.5 tests available on
aarch64. Unfortunately, the newer images don't work, due to the fact
that internal VM networking is not properly configured: specifically,
the VM is able to ask for networking configuration to the external
dnsmasq service, but the configuration is, for some reason, re-set
after OS booting. While we investigate this issue, use the working
old image. Furtunately, the old image has a recent enough cmake
version (3.27.4).

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
@ekoops
Copy link
Contributor Author

ekoops commented Dec 18, 2025

/hold cancel

Copy link
Collaborator

@therealbobo therealbobo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm!

@poiana
Copy link

poiana commented Dec 18, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, therealbobo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit bff5120 into falcosecurity:main Dec 18, 2025
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants