<p>Hope you can help.</p>
<p>I am trying to enable audit logging in a docker container so if anybody <code>kubectl exec</code> to a docker container and runs any commands, then those commands get logged and we can view them in <code>kubectl logs</code> and capture with <code>fluentd</code> for example.</p>
<p>An option with adding the following line to <code>/etc/profile</code> of a container works for <code>root</code> but not for a <code>non-root</code> user as <code>/proc/1/fd/1</code> is owned and writable by only <code>root</code> user and changing ownership or permissions, is not an option, unfortunately.</p>
<pre><code>trap 'echo &quot;$USER&quot;:&quot;$BASH_COMMAND&quot; &gt;&gt; /proc/1/fd/1' DEBUG
</code></pre>
<p>So far have tried the following:</p>
<ul>
<li>A working option would be to run the container as a <code>non-root</code>, but unfortunately this is not an option</li>
<li>Option with just changing permissions/ownership doesn't change permissions/ownership</li>
<li>Also adding <code>mesg y</code> to <code>/etc/profile</code> to allow access to root's didn't work either as when doing <code>su - non-root</code> the permission gets denied (<code>mesg: cannot open /dev/pts/2: Permission denied</code>) - cannot change the permission</li>
<li>An option with adding a special file and trying to redirect the logs from there didn't work either, still the permission gets denied. For example:</li>
</ul>
<pre><code>mkfifo -m 666 /tmp/logpipe  #create the special file
trap 'echo &quot;$USER&quot;:&quot;$BASH_COMMAND&quot; &lt;&gt; /tmp/logpipe &gt; /proc/1/fd/1' DEBUG  # in /etc/profile
</code></pre>
<ul>
<li>Changing to <code>trap 'echo &quot;$USER&quot;:&quot;$BASH_COMMAND&quot;' DEBUG</code> won't work either as the logs need to go to <code>/proc/1/fd/1</code> in case of docker</li>
</ul>
<p>How would you enable command line audit logging in docker container or workaround the <code>/proc/1/fd/1</code> permission issue for <code>non-root</code> in a container run as <code>root</code> user?</p>
<p>Any ideas highly appreciated.</p>

<p>Ah, came across my own question :D
So, <a href="https://falco.org/" rel="nofollow noreferrer">Falco</a> can be used as a HIDS (Host-based intrusion detection system), which will alert on any unusual activity based on rules defined in Flaco configuration. This can be deployed as a Deamonset (privileged) or directly on nodes.</p>
