gvisor

type Identity ¶ added in v0.3.310

type Identity struct {
	ContainerID    string
	SandboxID      string
	RuntimeHandler string
	Namespace      string
	PodName        string
	PodUID         string
	ContainerName  string
}

Identity contains only allowlisted local-runtime inventory fields. It does not authenticate the trace sender or identify an actor/session.

type IntegrationConfig ¶ added in v0.3.310

type IntegrationConfig struct {
	Enabled         bool   `mapstructure:"enabled"`
	SocketPath      string `mapstructure:"socketPath"`
	RuntimeEndpoint string `mapstructure:"runtimeEndpoint"`
	RuntimeHandler  string `mapstructure:"runtimeHandler"`
}

IntegrationConfig enables a separate experimental observation source. Empty configuration performs no I/O. RuntimeEndpoint defaults to the node's CRI socket at the call site; RuntimeHandler defaults to runsc.

func (c IntegrationConfig) Validate() error

type InventoryLookup ¶ added in v0.3.310

type InventoryLookup func(context.Context, string) (Identity, error)

type Observation ¶ added in v0.3.310

type Observation struct {
	Start
	Identity Identity
	Node     string
}

Observation is distinct from an exec event, profile entry or security alert. Container/start precedes application execution. ObservedAt is receiver time.

type Receiver ¶

type Receiver struct {
	SocketPath string
	Resolve    Resolver
	OnStart    StartHandler
	// contains filtered or unexported fields
}

Receiver is an experimental, opt-in SecCheck remote sink listener. It does not configure runsc or acquire its single Default trace session.

func (r *Receiver) QueueDrops() uint64

func (r *Receiver) Run(ctx context.Context) error

func (r *Receiver) Stats() Stats

type Resolver ¶

type Resolver func(containerID string) bool

Resolver checks a claimed container ID against the local runtime inventory. The receiver never attributes an unverified claim to a Kubernetes workload.

type Start ¶

type Start struct {
	Source      string
	ContainerID string
	ObservedAt  time.Time
	Dropped     uint32 // Cumulative sender-reported drop count on this connection.
}

Start is the entire retained event. In particular, Args, Cwd, Env, and raw protobuf bytes must never be added to this type or passed to the callback.

type StartHandler ¶

type StartHandler func(context.Context, Start)

StartHandler receives only runtime-verified start events. It must honor ctx cancellation, including interrupting any blocking I/O, so Run can finish.

type Stats ¶ added in v0.3.299

type Stats struct {
	AcceptedConnections uint64 `json:"accepted_connections"`
	RejectedConnections uint64 `json:"rejected_connections"`
	ClosedConnections   uint64 `json:"closed_connections"`
	Handshakes          uint64 `json:"handshakes"`
	HandshakeErrors     uint64 `json:"handshake_errors"`
	ReceivedFrames      uint64 `json:"received_frames"`
	ReadErrors          uint64 `json:"read_errors"`
	InterruptedReads    uint64 `json:"interrupted_reads"`
	InvalidFrames       uint64 `json:"invalid_frames"`
	UnresolvedStarts    uint64 `json:"unresolved_starts"`
	IgnoredFrames       uint64 `json:"ignored_frames"`
	VerifiedStarts      uint64 `json:"verified_starts"`
	CallbacksCompleted  uint64 `json:"callbacks_completed"`
	SenderDropFrames    uint64 `json:"sender_drop_frames"`
	QueueDrops          uint64 `json:"queue_drops"`
}

Stats is a process-local diagnostic snapshot. During collection fields are read independently. After Run returns all receiver workers have finished. It contains no message payload, container identity or command arguments.