zwass
08/17/2022, 10:20 PMdocker_containers
table)? Not sure if @Artemis Tosini’s cgroup work will help with this. In current osquery, best I've come up with is select * from processes join process_namespaces using (pid) where cgroup_namespace != (select cgroup_namespace from process_namespaces where pid = 1);
(eg. check for a different cgroup than the init process), though I think this will pick up other processes using cgroups besides just containers. I'm looking to do this in order to take advantage of the pid_with_namespace
column @Stefano Bonicatti added to some tables.alessandrogario
08/17/2022, 11:14 PMStefano Bonicatti
08/18/2022, 12:02 AMzwass
08/18/2022, 12:33 AMI don't think a "container" exists per seYeah that all sounds right. Maybe we could come up with a heuristic for detecting container processes in some different runtimes? Eg. Docker (and by extension
containerd
?) seems to have a parent process of containerd-shim
.
So maybe if you take the cgroup IDs of every direct child process of containerd-shim
then you can treat each of those as the cgroup for a container?alessandrogario
08/18/2022, 12:37 AMzwass
08/18/2022, 1:10 AMsudo ctr --address /var/snap/microk8s/common/run/containerd.sock -n <http://k8s.io|k8s.io> c ls
containerd_containers
, containerd_images
, containerd_namespaces
containerd_events
could be interesting as wellsudo ctr --address /var/snap/microk8s/common/run/containerd.sock -n <http://k8s.io|k8s.io> events
seems to stream those eventsalessandrogario
08/18/2022, 1:14 AMzwass
08/18/2022, 1:14 AMalessandrogario
08/18/2022, 1:15 AMzwass
08/18/2022, 1:15 AMArtemis Tosini
08/18/2022, 2:23 PM