Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SubsystemMountpoints() can return wong V2 path for non-root container environments #139

Closed
fearful-symmetry opened this issue Apr 10, 2024 · 0 comments · Fixed by #136
Closed
Labels
bug Something isn't working Team:Elastic-Agent Label for the Agent team

Comments

@fearful-symmetry
Copy link
Contributor

Right now, SubsystemMountpoints() will calculate the V2 mountpoint by iterating through /proc/self/mountpoints and and updating the V2Loc as it finds it in the file, ending with the last result. Problem is, some mountpoints files look like this:

1682 1681 0:26 / /sys/fs/cgroup ro,nosuid,nodev,noexec,relatime - cgroup2 cgroup rw,seclabel
1718 1686 0:26 / /hostfs/sys/fs/cgroup rw,nosuid,nodev,noexec,relatime master:4 - cgroup2 cgroup2 rw,seclabel
1771 1770 0:26 / /hostfs/var/lib/docker/overlay2/1b570230fa3ec3679e354b0c219757c739f91d774ebc02174106488606549da0/merged/sys/fs/cgroup ro,nosuid,nodev,noexec,relatime - cgroup2 cgroup rw,seclabel

In this case, the last mountpoint is /hostfs/var/lib/docker/overlay2/1b570230fa3ec3679e354b0c219757c739f91d774ebc02174106488606549da0/merged/sys/fs/cgroup

Problem is, this is a docker overlayfs path, and if the container is running as non-root --user=whomever, then we can't read from this file.

The hostfs path works fine:

cat /hostfs/sys/fs/cgroup/user.slice/user-1000.slice/session-1763.scope/io.pressure 
some avg10=0.00 avg60=0.00 avg300=0.00 total=2256657
full avg10=0.00 avg60=0.00 avg300=0.00 total=1667639
@fearful-symmetry fearful-symmetry added the bug Something isn't working label Apr 10, 2024
fearful-symmetry added a commit that referenced this issue Apr 18, 2024
…tainer (#140)

## What does this PR do?
Closes elastic/beats#38241

This adds a lightweight test framework that runs a set of system tests
under a container with the goal of monitoring the host system. The goal
with these tests is to catch the numerous edge cases that happen when
the system metrics function from a `/hostfs` path inside a container.

The tests have a fairly large matrix of configurations, as we need to
test both a wide variety of container permission settings, as well as
differences in how linux distros will configure cgroups.

The framework here was designed with the goal of being relatively
idiomatic; you can just run the framework with `go test` as you would
normally.

You can run the tests yourself with `go test -v ./tests`

As you may have noticed, there's a non-zero amount of TODO statements
here, since these tests were built to aggravate a bunch of existing
bugs, so certain parts of the tests will remain un-implemented until
those bugs are fixed.

## Why is it important?

See elastic/beats#38241, we really need test
for this particular case.

## List of bugs that are responsible for TODO statements in the tests:

- #141
- #135
- #139
- #132
- elastic/go-sysinfo#12

## Checklist

- [x] My code follows the style guidelines of this project
- [x] I have commented my code, particularly in hard-to-understand areas
- [x] I have added tests that prove my fix is effective or that my
feature works
- [ ] I have added an entry in `CHANGELOG.md`
@pierrehilbert pierrehilbert added the Team:Elastic-Agent Label for the Agent team label Apr 22, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working Team:Elastic-Agent Label for the Agent team
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants