From a4d3d4d7317f278a713065f87f82ab207a9fec01 Mon Sep 17 00:00:00 2001
From: Mark Stemm <mark.stemm@sysdig.com>
Date: Fri, 25 Aug 2017 08:05:58 -0700
Subject: [PATCH] Also let docker-runc denote an entrypoint.

---
 rules/falco_rules.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index fd2e7a37..14c28dec 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -644,7 +644,7 @@
 #   where at the time 2:INIT execs the root program, 0:PARENT might have
 #   already exited, or might still be around. So we handle both.
 - macro: container_entrypoint
-  condition: (not proc.pname exists or proc.pname=runc:[0:PARENT])
+  condition: (not proc.pname exists or proc.pname in (runc:[0:PARENT], docker-runc))
 
 - rule: Launch Sensitive Mount Container
   desc: >