Documentation
¶
Overview ¶
Package gvisor receives a narrow subset of gVisor's SecCheck remote sink. The first supported signal is container/start. The wire message contains command arguments and a working directory, so only allowlisted identity fields may leave the decoder.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Receiver ¶
type Receiver struct {
SocketPath string
Resolve Resolver
OnStart StartHandler
// contains filtered or unexported fields
}
Receiver is an experimental, opt-in SecCheck remote sink listener. It does not configure runsc or acquire its single Default trace session.
func (*Receiver) QueueDrops ¶
QueueDrops counts locally discarded events when the consumer cannot keep up.
type Resolver ¶
Resolver checks a claimed container ID against the local runtime inventory. The receiver never attributes an unverified claim to a Kubernetes workload.
type Start ¶
type Start struct {
Source string
ContainerID string
ObservedAt time.Time
Dropped uint32 // Cumulative sender-reported drop count on this connection.
}
Start is the entire retained event. In particular, Args, Cwd, Env, and raw protobuf bytes must never be added to this type or passed to the callback.
type StartHandler ¶
StartHandler receives only runtime-verified start events. It must honor ctx cancellation, including interrupting any blocking I/O, so Run can finish.
Source Files