zwass
docker_containers
table)? Not sure if @Artemis Tosini’s cgroup work will help with this. In current osquery, best I've come up with is select * from processes join process_namespaces using (pid) where cgroup_namespace != (select cgroup_namespace from process_namespaces where pid = 1);
(eg. check for a different cgroup than the init process), though I think this will pick up other processes using cgroups besides just containers. I'm looking to do this in order to take advantage of the pid_with_namespace
column @Stefano Bonicatti added to some tables.alessandrogario
Stefano Bonicatti
08/18/2022, 12:02 AMzwass
I don't think a "container" exists per seYeah that all sounds right. Maybe we could come up with a heuristic for detecting container processes in some different runtimes? Eg. Docker (and by extension
containerd
?) seems to have a parent process of containerd-shim
.
So maybe if you take the cgroup IDs of every direct child process of containerd-shim
then you can treat each of those as the cgroup for a container?alessandrogario
zwass
sudo ctr --address /var/snap/microk8s/common/run/containerd.sock -n <http://k8s.io|k8s.io> c ls
containerd_containers
, containerd_images
, containerd_namespaces
containerd_events
could be interesting as wellsudo ctr --address /var/snap/microk8s/common/run/containerd.sock -n <http://k8s.io|k8s.io> events
seems to stream those eventsalessandrogario
zwass
alessandrogario
zwass
Artemis Tosini
08/18/2022, 2:23 PM