Mount /proc filesystem

[chi-onu]

Greetings,

I have a security sensor I have installed on an ECS Bottlerocket instance, unfortunately the error I am getting which prevents the sensor from running is "Missing host /proc filesystem mount". I have attempted to go through the documentation in hopes of resolving the issue to no luck. Can anyone please assist with this.

[samuelkarp]

Hi @chi-onu! I'm not sure what security sensor you're attempting to run; you might be able to ask the vendor of that sensor about the error message. However, the message you included here suggests that you might need to add a volume mount of the /proc directory on the host to your ECS task definition.

[chi-onu]

@samuelkarp thank you so much for your feedback. I figured as much but with Bottlerocket being locked down, are there are special configs we need to add into the user-data.toml to allow us access to the /proc filesystem? Any documentation you can point me to showing some example or could help me out would be greatly appreciated.

[chi-onu]

I was able to run the sensor on a Bottlerocket EKS instance with no issues. ECS seems to be giving me a run for my money.