Manual
Deployment Steps
Install the Sysdig orchestrator agent via Terraform or CloudFormation, as described in the alternate instructions. Take note of the
OrchestratorHost
andOrchestratorPort
values, as you will need to pass these as environment variables to your workload containers.Add a new container to your existing task definition. Give it a name, such as
sysdigInstrumentation
. Use thequay.io/sysdig/workload-agent:latest
image for this container, and leave theentrypoint
andcommand
fields empty.Edit the containers that you want to instrument. Add a
volume mount
from thesysdigInstrumentation
container to your workload container, and mount the/host/var/run/docker.sock
directory into thesysdigInstrumentation
container as well.Add the
SYS_PTRACE
capability to your workload container. You can do this by adding the following to your container definition:"linuxParameters": { "capabilities": { "add": ["SYS_PTRACE"] } }
Prepend
/opt/draios/bin/instrument
to the entrypoint of your workload container.For example, if your original entrypoint is
["my", "original", "entrypoint"]
, it becomes["/opt/draios/bin/instrument", "my", "original", "entrypoint"]
.Set the
SYSDIG_ORCHESTRATOR
andSYSDIG_ORCHESTRATOR_PORT
environment variables in your workload container to the values that you obtained in step.For example:
"environment": [ {"name": "SYSDIG_ORCHESTRATOR", "value": "orchestrator.example.com"}, {"name": "SYSDIG_ORCHESTRATOR_PORT", "value": "6667"} ]
Save your updated task definition, and then deploy it to your ECS cluster.
With these steps, you can manually instrument your task definition to deploy the Sysdig Workload Agent. Note that this method requires more manual configuration than using serverless-patcher
or including the Sysdig Workload Agent in your container image, but it gives you more control over the instrumentation process.
Next Steps
After the deployment completes, security-related events will be visible in the Sysdig Secure Events feed.
Optionally, you can perform advanced Configuration steps.
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.