The kernel module becomes incompatible because there are some syscalls used by docker container that failed to return when trying to disable features or upgrade Deep Security Agent.

Checking the Deep Security kernel module (TMhook)

1. When Deep Security module is enabled, verify that the kernel module version in disk and in memory are the same.
   • Get the kernel module version in disk:

     # sudo modinfo /opt/ds_agent/`uname -r`/tmhook.ko

   • Identify the kernel module version in memory:

     # sudo cat /proc/driver/bmhook/tmhook/version

2. When Deep Security module is disabled, make sure the kernel module status is unload.

   # sudo lsmod | grep tmhook

Workarounds

There are two (2) workarounds to resolve the kernel module incompatibility issue.

• Option 1. Stop all the running docker containers. Enable one of the Deep Security modules mentioned above, and then disable it.
• Option 2. Reboot the agent.