2026-11-09T06:13:56Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:13:56.190517139+0000: Critical Executing binary not part of base image | proc_exe=mount proc_sname= gparent= proc_exe_ino_ctime=1794203237390967569 proc_exe_ino_mtime=1785512076000000000 proc_exe_ino_ctime_duration_proc_start=1598799138907 proc_cwd=./ container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=mount proc_exepath=/usr/bin/mount parent= command=mount -t tmpfs -o size=8195915776,noswap tmpfs /var/lib/kubelet/pods/d42c65e5-c468-4816-8f47-429406851698/volumes/kubernetes.io~projected/kube-api-access-cfx4d terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=be887bb8898aacd44dc9cf51589cc1cd 2026-11-09T06:13:56Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:13:56.338136276+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/calico proc_sname= gparent= proc_exe_ino_ctime=1794203385420700812 proc_exe_ino_mtime=1794203384969698646 proc_exe_ino_ctime_duration_proc_start=1450917097190 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=calico proc_exepath=/opt/cni/bin/calico parent=containerd command=calico terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=24c0a1407ae157013bcbfede93fbe679 2026-11-09T06:13:56Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:13:56.338135853+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/loopback proc_sname= gparent= proc_exe_ino_ctime=1794203387120708973 proc_exe_ino_mtime=1794203387113708939 proc_exe_ino_ctime_duration_proc_start=1449217068544 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=loopback proc_exepath=/opt/cni/bin/loopback parent=containerd command=loopback terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=4887fa2a067d24c734557d564044bd92 2026-11-09T06:13:56Z INF event event="Contact K8S API Server From Container" output="2026-11-09T06:13:56.431810086+0000: Notice Unexpected connection to K8s API Server from container | connection=172.18.0.2:59416->10.96.0.1:443 lport=443 rport=59416 fd_type=ipv4 fd_proto=tcp evt_type=connect user=root user_uid=0 user_loginuid=-1 process=calico proc_exepath=/opt/cni/bin/calico parent=containerd command=calico terminal=0" priority=Notice source=syscall trace_id=e30c21240cef1eac0937b8b231a41362 2026-11-09T06:13:56Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:13:56.461322619+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/calico-ipam proc_sname= gparent=containerd proc_exe_ino_ctime=1794203386863707739 proc_exe_ino_mtime=1794203385745702372 proc_exe_ino_ctime_duration_proc_start=1449597309706 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=calico-ipam proc_exepath=/opt/cni/bin/calico-ipam parent=calico command=calico-ipam terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=087d5baa05fbcf90af5eac5f4a1bb6c8 2026-11-09T06:13:56Z INF event event="Contact K8S API Server From Container" output="2026-11-09T06:13:56.550851790+0000: Notice Unexpected connection to K8s API Server from container | connection=172.18.0.2:59428->10.96.0.1:443 lport=443 rport=59428 fd_type=ipv4 fd_proto=tcp evt_type=connect user=root user_uid=0 user_loginuid=-1 process=calico-ipam proc_exepath=/opt/cni/bin/calico-ipam parent=calico command=calico-ipam terminal=0" priority=Notice source=syscall trace_id=df2327e64c89fde3ed5188a4784504d7 2026-11-09T06:13:56Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:13:56.652250538+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/portmap proc_sname= gparent= proc_exe_ino_ctime=1794203387134709040 proc_exe_ino_mtime=1794203387128709011 proc_exe_ino_ctime_duration_proc_start=1449517088711 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=portmap proc_exepath=/opt/cni/bin/portmap parent=containerd command=portmap terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=e0f85fe0936dcb8591090306dfae0d82 2026-11-09T06:13:57Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:13:57.150359132+0000: Critical Executing binary not part of base image | proc_exe=mount proc_sname=runc:[1:CHILD] gparent=runc:[1:CHILD] proc_exe_ino_ctime=1794203237390967569 proc_exe_ino_mtime=1785512076000000000 proc_exe_ino_ctime_duration_proc_start=1599758981149 proc_cwd=/run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/ container_start_ts=1794204836957360535 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=mount proc_exepath=/usr/bin/mount parent=mount-product-f command=mount -o ro,bind /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/product_name /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/sys/class/dmi/id/product_name terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=1ac0f4df6ef718c70748663a0da654b4 2026-11-09T06:13:57Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:13:57.154657979+0000: Critical Executing binary not part of base image | proc_exe=mount proc_sname=runc:[1:CHILD] gparent=runc:[1:CHILD] proc_exe_ino_ctime=1794203237390967569 proc_exe_ino_mtime=1785512076000000000 proc_exe_ino_ctime_duration_proc_start=1599763168700 proc_cwd=/run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/ container_start_ts=1794204836957360535 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=mount proc_exepath=/usr/bin/mount parent=mount-product-f command=mount -o ro,bind /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/product_uuid /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/sys/class/dmi/id/product_uuid terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=b2f93366787ea8c467320fe505d03ce1 2026-11-09T06:13:57Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:13:57.159098896+0000: Critical Executing binary not part of base image | proc_exe=mount proc_sname=runc:[1:CHILD] gparent=runc:[1:CHILD] proc_exe_ino_ctime=1794203237390967569 proc_exe_ino_mtime=1785512076000000000 proc_exe_ino_ctime_duration_proc_start=1599767613313 proc_cwd=/run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/ container_start_ts=1794204836957360535 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=mount proc_exepath=/usr/bin/mount parent=mount-product-f command=mount -o ro,bind /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/product_uuid /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/sys/devices/virtual/dmi/id/product_uuid terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=802b1f1ba34167423bd453215dc1e5d7