new(userspace/libsinsp): support lxc 4.0 cgroup layout.

[FedeDP]

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area libsinsp

Does this PR require a change in the driver versions?

What this PR does / why we need it:

LXC 4.0 uses a new cgroup prefix/layout: https://linuxcontainers.org/lxc/news/2020_03_25_13_03.html
This PR adds support for it.

Which issue(s) this PR fixes:

Fixes #

See falcosecurity/falco#3213

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

new(userspace/libsinsp): support lxc 4.0 cgroup layout.

[FedeDP]

/milestone 0.18.0

[FedeDP]

I was able to test it by spawning an lxc container and checking the container event:

sudo ./libsinsp/examples/sinsp-example -m -f evt.type=container
-- Try to open: 'modern_bpf' engine.
-- Engine 'modern_bpf' correctly opened.
-- Start capture
96105 09:10:43.645401098 cat=process container=mycontainer proc=container:mycontainer(-1.-1) ppid=-1 exe=container:mycontainer args=[container:mycontainer] > container json={"container":{"Mounts":[],"User":"<NA>","cni_json":"","cpu_period":100000,"cpu_quota":0,"cpu_shares":1024,"cpuset_cpu_count":0,"created_time":140725548835888,"env":[],"full_id":"","id":"mycontainer","image":"","imagedigest":"","imageid":"","imagerepo":"","imagetag":"","ip":"0.0.0.0","is_pod_sandbox":false,"labels":null,"lookup_state":1,"memory_limit":0,"metadata_deadline":0,"name":"mycontainer","pod_sandbox_id":"","pod_sandbox_labels":null,"port_mappings":[],"privileged":false,"swap_limit":0,"type":1}}

Most fields are empty because we actually only load the container id (that was already the case before my fix).

[Andreagit97]

/approve

[FedeDP]

I propose to backport this to the 0.17.1 tag, since it is an handy fix.

/milestone 0.17.1

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, LucaGuerra

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Andreagit97,FedeDP,LucaGuerra]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment