Title
#general
z

Zweasta

07/08/2020, 3:46 PM
sudo osqueryi --json 'select * from docker_container_ports'
is not showing any output even though there are docker ports associated with host ports.. Any idea ?
CptOfEvilMinions

CptOfEvilMinions

07/08/2020, 6:04 PM
I don’t know how Osquery does it under the hood but Osquery might be attempting to access the Docker unix socket. I would check that the user Osquery is running under has the proper permissions to access it. Try running
sudo usermod -aG docker $USER
z

Zweasta

07/08/2020, 6:54 PM
@CptOfEvilMinions I did
sudo usermod -aG docker $USER
but its still not showing any ports..
theopolis

theopolis

07/08/2020, 7:14 PM
(1) what if you try with
--verbose
(2) does
docker_containers
work?
z

Zweasta

07/08/2020, 7:42 PM
@theopolis (1) No useful logs related to the query (empty output for the query) (2) Yes
theopolis

theopolis

07/08/2020, 8:39 PM
That's about the extent of my debugging skills 😛, other than
strace
and seeing what is going wrong or if this is expected. @Seshu is the original author (may be a good SME) and here's the code implementation https://github.com/osquery/osquery/blob/master/osquery/tables/applications/posix/docker.cpp
s

Seshu

07/08/2020, 8:44 PM
Which version of docker @Zweasta. Also Linux or macOS?
z

Zweasta

07/08/2020, 8:45 PM
@Seshu
Docker version 19.03.5, build 633a0ea
Linux: CentOS
s

Seshu

07/08/2020, 9:00 PM
Does this show any output (because this is what Osquery does via code):
sudo curl -s --unix-socket /var/run/docker.sock -H 'Content-Type: application/json' <http://localhost/containers/json> | jq ".[] | .Ports"
z

Zweasta

07/08/2020, 9:07 PM
-bash: jq: command not found
(23) Failed writing body
This the the output
s

Seshu

07/08/2020, 9:09 PM
You have to install
jq
. Or skip the pipe and redirect the output to a file. Look for
Ports
in each entry
z

Zweasta

07/08/2020, 9:12 PM
[] [] Here is the output, after installing jq
s

Seshu

07/08/2020, 9:55 PM
That means docker is not reporting any ports for the two containers you have. Do you see any under Ports column when running docker CLI:
docker ps
z

Zweasta

07/08/2020, 9:59 PM
docker inspect --format '{{.Config.ExposedPorts}}' container-id
For this command I got output as:
map[27017/tcp:{}]
for one of the containers similarly, I have one port reporting for my other container
s

Seshu

07/08/2020, 10:31 PM
If you have
EXPOSE
in your
Dockerfile
that should show up in
docker_container_ports
in
port
column. When the container is run, if the container port is mapped to a host port, then
host_ip
and
host_port
will be non-empty.
10:31 PM
You should see 27017 in the table.
z

Zweasta

07/08/2020, 10:38 PM
So, you are saying, I don't have expose in my Dockerfile ?
s

Seshu

07/09/2020, 1:59 AM
• If
EXPOSE
exists in
Dockerfile
, you should see a row in
docker_container_ports
even if no process is listening on that port • Whether
EXPOSE
exists or not in Dockerfile, if you use
-p/--publish
option when running the container, that should show up in
docker_container_ports
. In this case host_ip and host_port should not be empty
z

Zweasta

07/09/2020, 12:27 PM
So, is there any way to figure out my issue here ?
s

Seshu

07/09/2020, 4:23 PM
You have to debug why docker is not reporting Ports (curl + jq). Nothing to do with Osquery.
z

Zweasta

07/09/2020, 5:07 PM
okay.. Thanks for pointing in the right direction!🙂