container_memory_used is always 0 on cgroup v2 #3136

Describe the bug

get_container_memory_used() in userspace/libsinsp/linux/resource_utilization.cpp reads /sys/fs/cgroup/memory/memory.usage_in_bytes, which is a cgroup v1 path. On a cgroup v2 node that file doesn't exist, fopen fails, the function returns without logging anything and the value stays at 0.

With the default metrics settings a field at 0 isn't printed, so container_memory_used just doesn't show up in the snapshot. I only saw the 0 after setting include_empty_values: true.

How to reproduce it

Install Falco with the Helm chart on a node with cgroup v2, enable metrics with resource_utilization_enabled: true and include_empty_values: true, and look at one snapshot:

falco.container_memory_used_mb=0.0
falco.host_memory_used_mb=1048.6
falco.memory_pss_mb=122.9
falco.memory_rss_mb=138.9

From inside the Falco container (kubectl exec -n falco <pod> -c falco):

$ cat /proc/self/cgroup
0::/kubepods.slice/kubepods-burstable.slice/kubepods-burstable-pod3a13d672_47ab_45c7_b40f_ef947382d178.slice/cri-containerd-0d035b9e4e6df298b327393e58b2a31bd5274b96d8d3a44703e5251c6117a3bb.scope
$ cat /sys/fs/cgroup/memory/memory.usage_in_bytes
cat: can't open '/sys/fs/cgroup/memory/memory.usage_in_bytes': No such file or directory
$ cat /sys/fs/cgroup/memory.current
cat: can't open '/sys/fs/cgroup/memory.current': No such file or directory
$ cat /sys/fs/cgroup$(cut -d: -f3 /proc/self/cgroup)/memory.current
117444608

Expected behaviour

container_memory_used reports the memory of the Falco container on cgroup v2 too. Here it should be around 112 MiB.

Environment

• Falco version: 0.45.0 (libs 0.26.0, engine modern_bpf, driver 11.0.0+driver)
• System info:

{
  "machine": "x86_64",
  "nodename": "falco-q722b",
  "release": "6.12.111+deb13-amd64",
  "sysname": "Linux",
  "version": "#1 SMP PREEMPT_DYNAMIC Debian 6.12.111-1 (2026-09-28)"
}

• Cloud provider or hardware configuration: bare metal laptop, single node k3s v1.36.5, containerd 2.3.4
• OS: Debian 13
• Kernel: 6.12.111+deb13-amd64
• Installation method: Kubernetes, falco Helm chart from https://falcosecurity.github.io/charts

Additional context

The fix isn't only swapping the file name. In a container with its own cgroup namespace the value is at /sys/fs/cgroup/memory.current, but the chart runs Falco privileged and containerd doesn't give a privileged container a cgroup namespace. As the output above shows, Falco sees the node's root cgroup, which has no memory.current, and its own value is under the path from /proc/self/cgroup.

I'd like to send a PR for this. Would you rather have this function resolve its own path from /proc/self/cgroup, or reuse the cgroup v2 support that libs already has?

Until then FALCO_CGROUP_MEM_PATH works as a workaround, I saw someone setting it by hand in falcosecurity/falco#3643 (comment)