Driver Modes

The Serverless Agent driver can operate in either Performance or Compatibility mode. Each mode has advantages and trade-offs but offers the same features and detection capabilities. The Driver operates in Performance mode by default.

Performance

The Performance mode uses a Sysdig proprietary instrumentation library built on top of ptrace. It offers the same data precision as kernel captures, full support for any type of executable, and overhead comparable to kernel instrumentation in the majority of workloads.

Compatibility

The Compatibility mode uses pure ptrace, reducing interference between Sysdig instrumentation and the secured workload application, though it comes with a performance trade-off. This mode can help factor out issues in the instrumented workload that occur in Performance mode.

Configure the Driver Mode

The Serverless Agent driver defaults to the Performance mode. You can switch to the Compatibility mode by providing the container running the instrumented application with the following environment variable:

SYSDIG_INSTRUMENTATION_LIBRARY="none"