mark@L-R910LPKW:~$ uname -r

I would like to be able to run tracee from a docker container, but it does not work on WSL2:

mark@L-R910LPKW:~$ sudo docker run --name tracee --rm --privileged --pid=host -v /lib/modules:/lib/modules:ro -v /usr/src:/usr/src:ro -v /tmp/tracee:/tmp/tracee aquasec/tracee:0.4.0 --trace comm=ls
2023/05/16 00:37:43 missing kernel source code compilation dependency

I understand that is because /usr/src (and /lib/modules?) is empty on my machine.

How can I populate them given it is not a real Linux box, but WSL2?

  • perhaps that docker wasn't made to run on WSL Commented May 16, 2023 at 1:02
  • I think it just needs the kernel sources and so the question how to set them up for WSL2
    – mark
    Commented May 16, 2023 at 3:34
  • sources or headers? if it's headers then perhaps installing linux-headers-{kernel version}-{architecture} will be sufficient Commented May 16, 2023 at 3:44

1 Answer 1


Using the distro's linux-headers package doesn't work here because the distro's kernel is not what's used in WSL2. Instead, Microsoft has a custom kernel that they ship, and all of the stuff in it is compiled in so it doesn't need an initramfs (which means it boots faster). Thus, /lib/modules is empty intentionally. Using the distro headers will result in a binary that simply doesn't load in your kernel since it will be for a different version.

It used to be that the WSL2 kernel did not support modules at all, but that has changed, according to the repository. There is some documentation associated with that repository about how to build a kernel, but it doesn't appear that Microsoft ships any sort of pre-built headers for this that can be used. You could, however, clone the repository under an appropriate subdirectory of /usr/src and build the kernel and/or any necessary modules there using the documentation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .