diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/socket.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/socket.bpf.c index 476dffb0c2..a2d3afd19a 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/socket.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/socket.bpf.c @@ -77,7 +77,11 @@ int BPF_PROG(socket_x, if(ret >= 0 && maps__get_socket_file_ops() == NULL) { struct task_struct *task = get_current_task(); - pid_t tgid = extract__task_xid_nr(task, PIDTYPE_TGID); + /* Please note that in `g_settings.scap_pid` scap will put its virtual pid + * if it is running inside a container. If we want to extract the same information + * in the kernel we need to extract the virtual pid of the task. + */ + pid_t vpid = extract__task_xid_vnr(task, PIDTYPE_TGID); /* it means that scap is performing the calibration */ if(tgid == maps__get_scap_pid()) {