Nabil Schear
05/20/2021, 6:00 PMmount_namespace_id
feature of various tables like deb_packages
? I have a docker container running and would like to be able to query the packages installed in the container. I am able to accomplish this using pid_with_namespace
and passing in a pid from the container. However, passing in the mount namespace id from select mnt_namespace from docker_containers;
returns no results.select * from deb_packages where mount_namespace_id in (select mnt_namespace from docker_containers);
Stefano Bonicatti
05/20/2021, 8:34 PMmount_namespace_id
it’s only there to be reported, it doesn’t let you join a namespace. Unfortunately the underlying API used on Linux to join a namespace (to be able to query things inside it) requires a pid.Nabil Schear
05/20/2021, 8:35 PMsudo osqueryi --json "select * from deb_packages where pid_with_namespace in (select pid from docker_containers where name='/c4bed2da-c9d7-4394-98f4-ec5b89a071fa');" | jq
E0520 18:10:24.668191 4093640 linux_table_container_ipc.cpp:443] Table deb_packages failed to retrieve QueryData from the container: Failed to read the entire message from the pipe of table deb_packages, read only 62020/90692 bytes
Stefano Bonicatti
05/20/2021, 8:36 PMNabil Schear
05/20/2021, 8:36 PMStefano Bonicatti
05/20/2021, 8:46 PMNabil Schear
05/20/2021, 8:52 PM$ sudo osqueryi --json "select * from os_version where pid_with_namespace in (select pid from docker_containers where name='/c4bed2da-c9d7-4394-98f4-ec5b89a071fa');"
[
{"arch":"x86_64","build":"","codename":"bionic","major":"18","minor":"4","name":"Ubuntu","patch":"0","platform":"ubuntu","platform_like":"debian","version":"18.04.5 LTS (Bionic Beaver)"}
]
Stefano Bonicatti
05/20/2021, 8:57 PMseph
Nabil Schear
05/20/2021, 11:14 PMStefano Bonicatti
05/21/2021, 9:42 AMNabil Schear
05/21/2021, 4:51 PM