Documentation
¶
Overview ¶
Package gvisor receives a narrow subset of gVisor's SecCheck remote sink. The first supported signal is container/start. The wire message contains command arguments and a working directory, so only allowlisted identity fields may leave the decoder.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Receiver ¶
type Receiver struct {
SocketPath string
Resolve Resolver
OnStart StartHandler
// contains filtered or unexported fields
}
Receiver is an experimental, opt-in SecCheck remote sink listener. It does not configure runsc or acquire its single Default trace session.
func (*Receiver) QueueDrops ¶
QueueDrops counts locally discarded events when the consumer cannot keep up.
type Resolver ¶
Resolver checks a claimed container ID against the local runtime inventory. The receiver never attributes an unverified claim to a Kubernetes workload.
type Start ¶
type Start struct {
Source string
ContainerID string
ObservedAt time.Time
Dropped uint32 // Cumulative sender-reported drop count on this connection.
}
Start is the entire retained event. In particular, Args, Cwd, Env, and raw protobuf bytes must never be added to this type or passed to the callback.
type StartHandler ¶
StartHandler receives only runtime-verified start events. It must honor ctx cancellation, including interrupting any blocking I/O, so Run can finish.
type Stats ¶ added in v0.3.299
type Stats struct {
AcceptedConnections uint64 `json:"accepted_connections"`
RejectedConnections uint64 `json:"rejected_connections"`
ClosedConnections uint64 `json:"closed_connections"`
Handshakes uint64 `json:"handshakes"`
HandshakeErrors uint64 `json:"handshake_errors"`
ReceivedFrames uint64 `json:"received_frames"`
ReadErrors uint64 `json:"read_errors"`
InterruptedReads uint64 `json:"interrupted_reads"`
InvalidFrames uint64 `json:"invalid_frames"`
UnresolvedStarts uint64 `json:"unresolved_starts"`
IgnoredFrames uint64 `json:"ignored_frames"`
VerifiedStarts uint64 `json:"verified_starts"`
CallbacksCompleted uint64 `json:"callbacks_completed"`
SenderDropFrames uint64 `json:"sender_drop_frames"`
QueueDrops uint64 `json:"queue_drops"`
}
Stats is a process-local diagnostic snapshot. During collection fields are read independently. After Run returns all receiver workers have finished. It contains no message payload, container identity or command arguments.
Source Files