-
Notifications
You must be signed in to change notification settings - Fork 809
Description
This is a bug report.
Expected behavior
Hosts running Flatcar Container Linux should have host detail information (private IP address, disk space, etc.) populated in the Fleet console, just like any other Linux distribution.
Actual behavior
Flatcar hosts enroll successfully and appear online in Fleet. Some host details populate (hardware model, OS name, memory, processor type), but platform-filtered detail queries — including network_interface_unix (IP/MAC), disk space, and others — are never sent to the host. Live queries for the same data return results correctly.
Steps to reproduce
- Enroll a Flatcar Container Linux host with Fleet (via Orbit or standalone osquery)
- Observe the host in Fleet console — Status shows "Online", some vitals populate
- Note that Private IP address is blank, Disk space shows "No data available"
- Run a live query for
SELECT * FROM interface_addresses— it returns data correctly
Root cause
Flatcar reports platform=flatcar and platform_like=coreos via osquery's os_version table. Neither flatcar nor coreos is present in HostLinuxOSs in server/fleet/hosts.go. This causes PlatformFromHost("flatcar") to return "" (empty string), and RunsForPlatform to skip all Linux-platform-filtered detail queries.
Proposed fix
Add "flatcar" and "coreos" to:
HostLinuxOSsinserver/fleet/hosts.goHostNeitherDebNorRpmPackageOSsinserver/fleet/hosts.go(neither distro uses deb or rpm)HOST_LINUX_PLATFORMSinfrontend/interfaces/platform.ts- Test cases in
server/fleet/hosts_test.go - Platform lists in
docs/Contributing/product-groups/orchestration/understanding-host-vitals.md
This is the same pattern used for other community-added distributions (tuxedo #19011, neon #28977, manjaro-arm #34357, etc.)
Context
- Fleet version: v4.81.1 (fleetctl), server v4.64.2
- osquery version: 5.21.0
- Flatcar Container Linux version: 4459.2.4
- Orbit version: 1.53.0
- Deployment method: systemd-sysext on Flatcar with Orbit managing osqueryd
Happy to submit a PR for this.