table)? Not sure if @Artemis Tosini’s cgroup work will help with this. In current osquery, best I've come up with is
(eg. check for a different cgroup than the init process), though I think this will pick up other processes using cgroups besides just containers. I'm looking to do this in order to take advantage of the
select * from processes join process_namespaces using (pid) where cgroup_namespace != (select cgroup_namespace from process_namespaces where pid = 1);
column @Stefano Bonicatti added to some tables.
Stefano Bonicatti08/18/2022, 12:02 AM
I don't think a "container" exists per seYeah that all sounds right. Maybe we could come up with a heuristic for detecting container processes in some different runtimes? Eg. Docker (and by extension
?) seems to have a parent process of
. So maybe if you take the cgroup IDs of every direct child process of
then you can treat each of those as the cgroup for a container?
sudo ctr --address /var/snap/microk8s/common/run/containerd.sock -n <http://k8s.io|k8s.io> c ls
could be interesting as well
seems to stream those events
sudo ctr --address /var/snap/microk8s/common/run/containerd.sock -n <http://k8s.io|k8s.io> events
Artemis Tosini08/18/2022, 2:23 PM