github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-19 14:47:04 +00:00
Code Issues Projects Releases Wiki Activity

fix(restart_handler): disable if there is no work

Browse Source 
When there is no work to do, i.e. when all config watching is disabled,
there is no need to keep the restart_handler running. Disable it in this
case.

This is helpful to do on nodes where there is little to no headroom in
terms of open inotify watches (as per the inotify/max_user_instances
configuration), as can happen on nodes populated with other software
that also watch the filesystem for changes. If Falco is run on such a
node, it may fail to start due to functionality the app does not even
intend on using.

This has one change in terms of behaviour, however: the dry-run restarts
will no longer occur. As there is still never going to happen a real
restart, I understand it as unlikely for there to be a proper need for
dry-run restarts.

Signed-off-by: Mariell Hoversholm <mariell@grafana.com>
This commit is contained in:
Mariell Hoversholm 2025-07-09 15:40:01 +02:00 committed by poiana
parent 5e2925bc95
commit c3fc9e0d0f
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
userspace/falco/app/restart_handler.cpp
View File

@ -38,7 +38,9 @@ limitations under the License.
falco::app::restart_handler::~restart_handler() {
stop();
close(m_inotify_fd);
if(m_inotify_fd != -1) {
close(m_inotify_fd);
}
m_inotify_fd = -1;
}
@ -48,6 +50,12 @@ void falco::app::restart_handler::trigger() {
bool falco::app::restart_handler::start(std::string& err) {
#ifdef __linux__
if(m_watched_files.empty() && m_watched_dirs.empty()) {
falco_logger::log(falco_logger::level::DEBUG,
"Refusing to start restart handler due to nothing to watch\n");
return true;
}
m_inotify_fd = inotify_init();
if(m_inotify_fd < 0) {
err = "could not initialize inotify handler";

2
userspace/falco/app/restart_handler.h
View File

@ -61,7 +61,7 @@ public:
private:
void watcher_loop() noexcept;
int m_inotify_fd;
int m_inotify_fd = -1;
std::thread m_watcher;
std::atomic<bool> m_stop;
std::atomic<bool> m_forced;