Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(libsinsp/runc): use old logic and fallback for containerd #2235

Merged
merged 3 commits into from
Jan 16, 2025

Conversation

therealbobo
Copy link
Contributor

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

The new logic is not always accurate. This readopts the old logic and adds a fallback to support containerd vanilla containers.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

@poiana poiana requested review from hbrueckner and leogr January 15, 2025 17:21
@therealbobo therealbobo changed the title Therealbobo misc fix(libsinsp/runc): use old logic and fallback for containerd Jan 15, 2025
Copy link

github-actions bot commented Jan 15, 2025

Perf diff from master - unit tests

     8.27%     +1.19%  [.] sinsp_evt::get_type
     3.96%     -0.74%  [.] sinsp_thread_manager::find_thread
     9.97%     -0.71%  [.] sinsp_parser::reset
     5.47%     +0.41%  [.] next_event_from_file
     0.73%     +0.35%  [.] libsinsp::events::is_unknown_event
     3.79%     -0.34%  [.] sinsp_evt::load_params
     2.74%     +0.33%  [.] sinsp_parser::process_event
     1.78%     -0.28%  [.] scap_event_decode_params
    10.61%     -0.24%  [.] sinsp::next
     0.54%     +0.23%  [.] sinsp_fdtable::find

Heap diff from master - unit tests

peak heap memory consumption: -253B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: -253B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            -0.0003         -0.0003           148           148           148           148
BM_sinsp_split_median                                          +0.0037         +0.0036           147           148           147           148
BM_sinsp_split_stddev                                          -0.4719         -0.4718             1             1             1             1
BM_sinsp_split_cv                                              -0.4718         -0.4716             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  -0.0046         -0.0046            62            62            62            62
BM_sinsp_concatenate_paths_relative_path_median                -0.0063         -0.0063            62            61            62            61
BM_sinsp_concatenate_paths_relative_path_stddev                -0.0789         -0.0785             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_cv                    -0.0747         -0.0742             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     -0.0325         -0.0325            25            24            25            24
BM_sinsp_concatenate_paths_empty_path_median                   -0.0317         -0.0318            25            24            25            24
BM_sinsp_concatenate_paths_empty_path_stddev                   -0.6038         -0.6043             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       -0.5905         -0.5910             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  +0.0094         +0.0094            61            62            61            62
BM_sinsp_concatenate_paths_absolute_path_median                +0.0115         +0.0115            61            62            61            62
BM_sinsp_concatenate_paths_absolute_path_stddev                -0.4345         -0.4344             1             1             1             1
BM_sinsp_concatenate_paths_absolute_path_cv                    -0.4398         -0.4397             0             0             0             0
BM_sinsp_split_container_image_mean                            -0.0107         -0.0107           391           387           391           387
BM_sinsp_split_container_image_median                          -0.0151         -0.0151           392           386           392           386
BM_sinsp_split_container_image_stddev                          +0.4375         +0.4378             2             3             2             3
BM_sinsp_split_container_image_cv                              +0.4530         +0.4534             0             0             0             0

Copy link

codecov bot commented Jan 15, 2025

Codecov Report

Attention: Patch coverage is 59.25926% with 11 lines in your changes missing coverage. Please review.

Project coverage is 75.11%. Comparing base (5891ebd) to head (46d0c28).
Report is 3 commits behind head on master.

Files with missing lines Patch % Lines
userspace/libsinsp/container_engine/containerd.cpp 30.00% 7 Missing ⚠️
userspace/libsinsp/runc.cpp 60.00% 4 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #2235      +/-   ##
==========================================
+ Coverage   75.09%   75.11%   +0.02%     
==========================================
  Files         276      276              
  Lines       34391    34395       +4     
  Branches     5927     5923       -4     
==========================================
+ Hits        25826    25836      +10     
+ Misses       8565     8559       -6     
Flag Coverage Δ
libsinsp 75.11% <59.25%> (+0.02%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

for(auto socket_path : cri_socket_paths) {
auto cri_engine =
std::make_shared<container_engine::cri>(*this, socket_path, engine_index);
m_container_engines.push_back(cri_engine);
m_container_engine_by_type[CT_CRI].push_back(cri_engine);
m_container_engine_by_type[CT_CRIO].push_back(cri_engine);
m_container_engine_by_type[CT_CONTAINERD].push_back(cri_engine);
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are various code path that assume that a cri runtime could have containerd as type.

@@ -617,7 +619,8 @@ void sinsp_container_manager::create_engines() {
m_container_engine_by_type[CT_BPM].push_back(bpm_engine);
}
if(m_container_engine_mask & (1 << CT_CONTAINERD)) {
auto containerd_engine = std::make_shared<container_engine::containerd>(*this);
auto containerd_engine =
std::make_shared<container_engine::containerd>(*this, engine_index);
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The containerd engine should address also by engine_index given that also the cri engines can be of containerd type. This way we always access the right container cache.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh right :/

Comment on lines +62 to +67
if(end_pos - start_pos == CONTAINER_ID_LENGTH &&
cgroup.find_first_not_of(CONTAINER_ID_VALID_CHARACTERS, start_pos) >= CONTAINER_ID_LENGTH) {
container_id = cgroup.substr(start_pos, REPORTED_CONTAINER_ID_LENGTH);
return true;
}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just going back to the old logic but, this time, we don't fail right away and we check if the cgroup name is compatible with a containerd one.

…een containerd sockets

Signed-off-by: Roberto Scolaro <[email protected]>
@FedeDP
Copy link
Contributor

FedeDP commented Jan 16, 2025

/milestone 0.20.0

@poiana poiana added this to the 0.20.0 milestone Jan 16, 2025
@therealbobo therealbobo marked this pull request as ready for review January 16, 2025 07:53
@poiana poiana requested a review from jasondellaluce January 16, 2025 07:53
Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Jan 16, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, therealbobo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana
Copy link
Contributor

poiana commented Jan 16, 2025

LGTM label has been added.

Git tree hash: 254e02e7033146d75e46797b5c3b092c85c5f5c4

Copy link
Member

@leogr leogr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, thank you for this fix!

@poiana poiana merged commit bceb3b1 into falcosecurity:master Jan 16, 2025
48 of 49 checks passed
@FedeDP FedeDP mentioned this pull request Jan 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: Todo
Development

Successfully merging this pull request may close these issues.

4 participants