feat(process-monitor): Detect new containers #213
Conversation
vadorovsky
force-pushed
the
runc
branch
9 times, most recently
from
bc49800
to
b43c665
Compare
vadorovsky
force-pushed
the
runc
branch
4 times, most recently
from
ae25f67
to
96e41d7
Compare
vadorovsky
force-pushed
the
runc
branch
4 times, most recently
from
11e1aab
to
407ce85
Compare
vadorovsky
force-pushed
the
runc
branch
4 times, most recently
from
b952273
to
64a4ec9
Compare
Enhance the process monitor with an ability to detect when a container runtime creates a new PID namespace, which we can consider as a creation of a new container. Achieve that by: * Registering the inodes of container runtime binaries we want to track in the user-space, saving them in a BPF map. * In BPF, every time a process is being executed using the runtime binary, checking whether the PID namespace was changed.
PID namespace can be omitted by passing `--pid=host` to Docker or podman. Checking mount namespace is more reliable.
* Don't show namespaces and `is_new_container` bool. * Show container info, but only if a process is containerized.
crates/pulsar-core/src/event.rs
Outdated
| #[validatron(skip)] | ||
| container: Option<ContainerInfo>, |
There was a problem hiding this comment.
this can be removed from here as it already present in the header. same thing for the fork event
There was a problem hiding this comment.
If I remove it there, I won't be able to use it here belowi, in the impl Format for Payload block:
There is no access to the header in this place.
There was a problem hiding this comment.
However, I can remove is_new_container, it's not needed in payloads.
There was a problem hiding this comment.
Done, I removed all namespace and container-related stuff from payloads, it's only in header now. And container details are getting formatted from header now.
crates/pulsar-core/src/event.rs
Outdated
| @@ -196,12 +199,18 @@ pub enum Payload { | |||
| Fork { | |||
| ppid: i32, | |||
| namespaces: Namespaces, | |||
There was a problem hiding this comment.
probably Namespaces should be included in the header via process_tracker and here should be a skip(validatron). in this way the only reason of having it in the fork event is an optimization to avoid multiple readings from /proc . what do you think?
Enhance the process monitor with an ability to detect when a
container runtime creates a new mount namespace, which we can consider
as a creation of a new container.
Achieve that by:
track in the user-space, saving them in a BPF map.
binary, checking whether the PID namespace was changed.