Kubernetes warns about hostPath volume type.

[ChristianAmmer]

The deployment files for installing the lacework agent on Kubernetes contain hostPath volume mounts. From the lacework-k8s.yaml file:

        volumeMounts:
          - name: sys
            mountPath: /sys
      volumes:
        - name: sys
          hostPath:
              path: /sys

This leads to the problem that container tools deployed into the lacework container will not work properly because they expect that the cgroup root is at /sys/fs/cgroup/. For example, the container's memory limit should be available via /sys/fs/cgroup/memory/memory.limit_in_bytes (e.g. as documented for Docker in Specify hard limits on memory). But with the sys mount, the container has the node view instead. This means /sys/fs/cgroup/memory/memory.limit_in_bytes is the limit of the node, not the container.

Additionally, the Kubernetes documentation recommends not using hostPath volume types as they introduce a security risk:

Warning:
Using the hostPath volume type presents many security risks. If you can avoid using a hostPath volume, you should. For example, define a local PersistentVolume, and use that instead.