fix container procfs root errors

[ethical-buddy]

1. Explain what the PR does

Fixes #5234.

This change makes ContainerPathResolver.GetHostAbsPath handle expected /proc//root access
failures more gracefully in the procfs fallback path.

Today, Tracee already skips stale or inaccessible cached PIDs when resolving a mount namespace root.
The gap was the fallback path: after GetAnyProcessInNS("mnt", mountNS) returns a PID, access to /
proc//root could still legitimately fail with:

• permission denied
• no such file or directory

Those cases are expected during event processing:

• ENOENT can happen if the selected process exits between namespace lookup and procfs access.
• EACCES can happen because of procfs/ptrace permission boundaries.

This PR changes that behavior so those expected failures are returned as ErrContainerFSUnreachable
instead of being treated as unexpected hard errors. Unexpected filesystem errors are still preserved
and returned.

The patch also preserves the underlying fs error chain in getProcessFSRoot, which is required for co
rrect errors.Is(..., fs.ErrPermission/fs.ErrNotExist) handling, and adds focused unit tests for:

• fallback permission denied
• fallback not found
• unexpected fallback fs error
  "Replace me with make check-pr output"

2. Explain how to test it

Run the focused tests:

go test ./pkg/datastores/container -run 'TestPathResolver_(GetHostAbsPath_ExpectedProcFSRootErrors|
GetHostAbsPath_UnexpectedProcFSRootError)' -count=1

What to verify:

• fs.ErrPermission from /proc//root is treated as ErrContainerFSUnreachable
• fs.ErrNotExist from /proc//root is treated as ErrContainerFSUnreachable
• unexpected fs errors are still returned as errors

If you want to exercise the runtime path, run Tracee with exec hash enrichment enabled and trigger
short-lived container processes. The important behavior is that transient /proc//root permission
denied / not found failures in container path resolution are treated as expected unreachable-
container cases rather than surfacing as hard resolver errors.

3. Other comments

###4. make check-pr
[2026-04-07T10:56:30.920359Z] [checkpatch.sh] [INFO] Tracee Checkpatch Script
[2026-04-07T10:56:30.924776Z] [checkpatch.sh] [INFO] Checking: HEAD
[2026-04-07T10:56:30.930741Z] [checkpatch.sh] [INFO] Comparing against: origin/main
[2026-04-07T10:56:30.941857Z] [checkpatch.sh] [INFO]
[2026-04-07T10:56:30.945734Z] [checkpatch.sh] [INFO] ==========================================
[2026-04-07T10:56:30.949514Z] [checkpatch.sh] [INFO] Dependency Check
[2026-04-07T10:56:30.953544Z] [checkpatch.sh] [INFO] ==========================================
[2026-04-07T10:56:30.958122Z] [checkpatch.sh] [INFO] Checking dependencies...
[2026-04-07T10:56:30.968601Z] [checkpatch.sh] [INFO] Adding Go bin directory to PATH: /home/suryansh/go/bin
[2026-04-07T10:56:30.981862Z] [checkpatch.sh] [INFO] Go version: go1.26
[2026-04-07T10:56:30.986259Z] [checkpatch.sh] [WARN] revive not found.
[2026-04-07T10:56:30.991212Z] [checkpatch.sh] [INFO] Install with: go install github.com/mgechev/revive@8ece20b0789c517bd3a6742db0daa4dd5928146d
[2026-04-07T10:56:30.995882Z] [checkpatch.sh] [WARN] staticcheck not found.
[2026-04-07T10:56:30.999844Z] [checkpatch.sh] [INFO] Install with: go install honnef.co/go/tools/cmd/staticcheck@5af2e5fc3b08ba46027eb48ebddeba34dc0bd02c
[2026-04-07T10:56:31.004388Z] [checkpatch.sh] [WARN] errcheck not found.
[2026-04-07T10:56:31.009256Z] [checkpatch.sh] [INFO] Install with: go install github.com/kisielk/errcheck@11c27a7ce69d583465d80d808817d22d6653ee34
[2026-04-07T10:56:31.013960Z] [checkpatch.sh] [WARN] govulncheck not found.
[2026-04-07T10:56:31.017718Z] [checkpatch.sh] [INFO] Install with: go install golang.org/x/vuln/cmd/govulncheck@d1f380186385b4f64e00313f31743df8e4b89a77
[2026-04-07T10:56:31.022070Z] [checkpatch.sh] [WARN] clang-format-12 not found.
[2026-04-07T10:56:31.026464Z] [checkpatch.sh] [INFO] Refer to your OS package manager Install via official package manager (e.g., 'sudo apt-get install clang-format-12')
[2026-04-07T10:56:31.030813Z] [checkpatch.sh] [WARN] goimports-reviser not found.
[2026-04-07T10:56:31.035181Z] [checkpatch.sh] [INFO] Install with: go install github.com/incu6us/goimports-reviser/v3@fa5587e51ba33c58734984cb41370a5b2582d5b7
[2026-04-07T10:56:31.040774Z] [checkpatch.sh] [INFO] [PASS] Dependencies check completed
[2026-04-07T10:56:31.045311Z] [checkpatch.sh] [INFO]
[2026-04-07T10:56:31.049589Z] [checkpatch.sh] [INFO] ==========================================
[2026-04-07T10:56:31.054023Z] [checkpatch.sh] [INFO] Documentation Verification
[2026-04-07T10:56:31.057837Z] [checkpatch.sh] [INFO] ==========================================
[2026-04-07T10:56:31.062265Z] [checkpatch.sh] [INFO] Verifying documentation synchronization...
[2026-04-07T10:56:31.083834Z] [verify_man_md_sync.sh] [INFO] ================================================================================
[2026-04-07T10:56:31.088391Z] [verify_man_md_sync.sh] [INFO] Comparing changes from origin/main to HEAD
[2026-04-07T10:56:31.093178Z] [verify_man_md_sync.sh] [INFO] ================================================================================
[2026-04-07T10:56:31.131223Z] [verify_man_md_sync.sh] [INFO] No changes in '.md' or '.1.md' files
[2026-04-07T10:56:31.135658Z] [verify_man_md_sync.sh] [INFO] No changes in '.1' files
[2026-04-07T10:56:31.150780Z] [verify_man_md_sync.sh] [INFO] Documentation files are consistent.
[2026-04-07T10:56:31.156240Z] [checkpatch.sh] [INFO] [PASS] Documentation Verification completed successfully
[2026-04-07T10:56:31.160455Z] [checkpatch.sh] [INFO]
[2026-04-07T10:56:31.164222Z] [checkpatch.sh] [INFO] ==========================================
[2026-04-07T10:56:31.168254Z] [checkpatch.sh] [INFO] Code Analysis
[2026-04-07T10:56:31.172673Z] [checkpatch.sh] [INFO] ==========================================
[2026-04-07T10:56:31.177142Z] [checkpatch.sh] [INFO] Verifying and analyzing code...
[2026-04-07T10:56:31.181478Z] [checkpatch.sh] [INFO] Running formatting checks...
[2026-04-07T10:56:31.291363Z] [checkpatch.sh] [ERROR] Code formatting failed
ERROR: clang-format version 22 found, but version 19 is required
Hint: Try installing clang-format-19 or ensure clang-format points to version 19
make[1]: *** [builder/Makefile.checkers:44: .check_clang-format] Error 1
[2026-04-07T10:56:31.301489Z] [checkpatch.sh] [ERROR] Code Analysis failed
make: *** [Makefile:1274: check-pr] Error 1