failure to compile eBPF on RedHat CoreOS 4.9 from sysdig 0.28.0 container

[chkp-eladmo]

We are unable to compile sysdig eBPF probe on RedHat CoreOS 4.9 from Sysdig 0.28.0 image.
Seems like there is toolchain package missing: libelf-devel.
Have also tried the following images:
sysdig 0.29.3 - same error
sysdig 0.27.1 - successful

Logs:

• Trying to compile the eBPF probe (scap_rhcos_4.18.0-305.30.1.el8_4.x86_64_1.o)
  make: Entering directory '/opt/sysdig/src/scap-2160111cd088aea9ae2235d3385ecb0b1ab6623c/bpf'
  make -C /lib/modules/4.18.0-305.30.1.el8_4.x86_64/build M=$PWD
  make[1]: Entering directory '/host/usr/src/kernels/4.18.0-305.30.1.el8_4.x86_64'
  make[1]: Leaving directory '/host/usr/src/kernels/4.18.0-305.30.1.el8_4.x86_64'
  Makefile:984: *** "Cannot generate ORC metadata for CONFIG_UNWINDER_ORC=y, please install libelf-dev, libelf-devel or elfutils-libelf-devel". Stop.
  make: Leaving directory '/opt/sysdig/src/scap-2160111cd088aea9ae2235d3385ecb0b1ab6623c/bpf'
  make: *** [Makefile:20: all] Error 2

[FedeDP]

Hi!
Thanks for opening this PR! It seems like the sysdig image (and the builder image) do not contain libelf-dev package; indeed, i see devtoolset-7-elfutils-libelf-devel: https://github.com/draios/sysdig/blob/dev/docker/builder/Dockerfile#L22; and this is i guess copy-pasted from https://github.com/falcosecurity/falco/blob/master/docker/builder/Dockerfile.
Can you try to install elfutils-devel?

[chkp-eladmo]

Hi
I've tried launching a container from image sysdig/sydig:0.28.0 pulled from dockerhub and install the missing elfutils-devel.
However seems that this image is based on redhat ubi, and the configured repositories don't provide that package.

:~$ docker run -it --entrypoint bash sysdig/sysdig:0.28.0
[root@65e289e8bca8 /]# yum install elfutils-devel
Updating Subscription Management repositories.
Unable to read consumer identity

This system is not registered with an entitlement server. You can use subscription-manager to register.

Red Hat Universal Base Image 8 (RPMs) - BaseOS 15 kB/s | 3.8 kB 00:00
Red Hat Universal Base Image 8 (RPMs) - BaseOS 946 kB/s | 804 kB 00:00
Red Hat Universal Base Image 8 (RPMs) - AppStream 18 kB/s | 4.2 kB 00:00
Red Hat Universal Base Image 8 (RPMs) - AppStream 3.0 MB/s | 3.0 MB 00:01
Red Hat Universal Base Image 8 (RPMs) - CodeReady Builder 16 kB/s | 3.8 kB 00:00
Red Hat Universal Base Image 8 (RPMs) - CodeReady Builder 34 kB/s | 18 kB 00:00
No match for argument: elfutils-devel
Error: Unable to find a match: elfutils-devel

[FedeDP]

Mmmh
/cc @LucaGuerra

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.