containerwatcher

package
v0.3.325 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 13, 2026 License: Apache-2.0 Imports: 63 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func CreateIGContainerWatcher 

func CreateIGContainerWatcher(
	cfg config.Config,
	containerProfileManager containerprofilemanager.ContainerProfileManagerClient,
	k8sClient *k8sinterface.KubernetesApi,
	igK8sClient *containercollection.K8sClient,
	dnsManagerClient dnsmanager.DNSManagerClient,
	metrics metricsmanager.MetricsManager,
	ruleManager rulemanager.RuleManagerClient,
	malwareManager malwaremanager.MalwareManagerClient,
	sbomManager sbommanager.SbomManagerClient,
	ruleBindingPodNotify *chan rulebindingmanager.RuleBindingNotify,
	runtime *containerutilsTypes.RuntimeConfig,
	thirdPartyEnricher containerwatcher.TaskBasedEnricher,
	processTreeManager processtree.ProcessTreeManager,
	clusterName string,
	objectCache objectcache.ObjectCache,
	networkStreamClient networkstream.NetworkStreamClient,
	containerProcessTree containerprocesstree.ContainerProcessTree,
	thirdPartyTracers containerwatcher.ThirdPartyTracers,
) (containerwatcher.ContainerWatcher, error)

CreateIGContainerWatcher creates a new container watcher with the ordered event processing design This function maintains compatibility with the v1 API while using the new v2 implementation

func GetHostAsContainer added in v0.3.17 

func GetHostAsContainer() (*containercollection.Container, error)

GetHostAsContainer creates a synthetic container representing the host's mount namespace. This enables host-level events to be processed through the standard container infrastructure.

Types

type ContainerWatcher 

type ContainerWatcher struct {
	// contains filtered or unexported fields
}

ContainerWatcher represents the new container watcher implementation

func CreateContainerWatcher 

func CreateContainerWatcher(
	cfg config.Config,
	containerProfileManager containerprofilemanager.ContainerProfileManagerClient,
	k8sClient *k8sinterface.KubernetesApi,
	igK8sClient *containercollection.K8sClient,
	dnsManagerClient dnsmanager.DNSManagerClient,
	metrics metricsmanager.MetricsManager,
	ruleManager rulemanager.RuleManagerClient,
	malwareManager malwaremanager.MalwareManagerClient,
	sbomManager sbommanager.SbomManagerClient,
	ruleBindingPodNotify *chan rulebindingmanager.RuleBindingNotify,
	runtime *containerutilsTypes.RuntimeConfig,
	thirdPartyEnricher containerwatcher.TaskBasedEnricher,
	processTreeManager processtree.ProcessTreeManager,
	clusterName string,
	objectCache objectcache.ObjectCache,
	networkStreamClient networkstream.NetworkStreamClient,
	containerProcessTree containerprocesstree.ContainerProcessTree,
	thirdPartyTracers containerwatcher.ThirdPartyTracers,
) (*ContainerWatcher, error)

CreateContainerWatcher creates a new container watcher with the ordered event processing design

func (*ContainerWatcher) GetContainerCollection 

func (cw *ContainerWatcher) GetContainerCollection() *containercollection.ContainerCollection

GetContainerCollection returns the container collection

func (*ContainerWatcher) GetContainerSelector 

func (cw *ContainerWatcher) GetContainerSelector() *containercollection.ContainerSelector

GetContainerSelector returns the container selector

func (*ContainerWatcher) GetSocketEnricher 

func (cw *ContainerWatcher) GetSocketEnricher() *socketenricher.SocketEnricher

GetSocketEnricher returns the socket enricher

func (*ContainerWatcher) GetTracerCollection 

func (cw *ContainerWatcher) GetTracerCollection() *tracercollection.TracerCollection

GetTracerCollection returns the tracer collection

func (*ContainerWatcher) Ready 

func (cw *ContainerWatcher) Ready() bool

Ready returns true if the container watcher is ready to process events

func (*ContainerWatcher) RegisterContainerReceiver 

func (cw *ContainerWatcher) RegisterContainerReceiver(receiver containerwatcher.ContainerReceiver)

func (*ContainerWatcher) Start 

func (cw *ContainerWatcher) Start(ctx context.Context) error

Start initializes and starts the container watcher

func (*ContainerWatcher) StartContainerCollection 

func (cw *ContainerWatcher) StartContainerCollection(ctx context.Context) error

StartContainerCollection starts the container collection

func (*ContainerWatcher) Stop 

func (cw *ContainerWatcher) Stop()

Stop gracefully stops the container watcher

func (*ContainerWatcher) StopContainerCollection 

func (cw *ContainerWatcher) StopContainerCollection()

StopContainerCollection stops the container collection

func (*ContainerWatcher) UnregisterContainerReceiver 

func (cw *ContainerWatcher) UnregisterContainerReceiver(receiver containerwatcher.ContainerReceiver)

UnregisterContainerReceiver unregisters a container receiver

type DroppedEvents added in v0.3.325 

type DroppedEvents struct {
	EventType   utils.EventType
	ContainerID string
	Count       int64
}

DroppedEvents is the number of events of one type dropped for one container because the queue was full. ContainerID may be empty for events that cannot be attributed to a container.

type EventEnricher 

type EventEnricher struct {
	// contains filtered or unexported fields
}

EventEnricher handles event enrichment with metrics and logging

func NewEventEnricher 

func NewEventEnricher(
	processTreeManager processtree.ProcessTreeManager,
) *EventEnricher

NewEventEnricher creates a new event enricher

func (*EventEnricher) EnrichEvents 

func (ee *EventEnricher) EnrichEvents(entry EventEntry) *ebpfevents.EnrichedEvent

type EventEntry added in v0.3.3 

type EventEntry struct {
	EventType   utils.EventType
	Event       utils.K8sEvent
	Timestamp   time.Time
	ContainerID string
	ProcessID   uint32
}

type EventHandlerFactory 

type EventHandlerFactory struct {
	// contains filtered or unexported fields
}

EventHandlerFactory manages the mapping of event types to their managers

func NewEventHandlerFactory 

func NewEventHandlerFactory(
	cfg config.Config,
	containerCollection *containercollection.ContainerCollection,
	containerProfileManager containerprofilemanager.ContainerProfileManagerClient,
	dnsManager dnsmanager.DNSManagerClient,
	ruleManager rulemanager.RuleManagerClient,
	malwareManager malwaremanager.MalwareManagerClient,
	networkStreamClient networkstream.NetworkStreamClient,
	metrics metricsmanager.MetricsManager,
	thirdPartyEventReceivers *maps.SafeMap[utils.EventType, mapset.Set[containerwatcher.GenericEventReceiver]],
	thirdPartyEnricher containerwatcher.TaskBasedEnricher,
	rulePolicyReporter *rulepolicy.RulePolicyReporter,
	dedupCache *dedupcache.DedupCache,
) *EventHandlerFactory

NewEventHandlerFactory creates a new event handler factory

func (*EventHandlerFactory) ContainerCallback added in v0.3.194 

func (ehf *EventHandlerFactory) ContainerCallback(notif containercollection.PubSubEvent)

ContainerCallback receives container lifecycle events so the factory can resolve container info for in-flight events across the container's end of life. On add, the lookup cache is warmed so even a container's first-ever event resolves after removal. On remove, eviction of the cache entry is deferred by removedContainerGracePeriod instead of relying on the live collection. Behavior is pinned by event_handler_factory_removal_test.go.

func (*EventHandlerFactory) ProcessEvent 

func (ehf *EventHandlerFactory) ProcessEvent(enrichedEvent *events.EnrichedEvent)

ProcessEvent processes an event through all registered handlers

type Manager 

type Manager any

Manager represents a component that can receive events

type ManagerAdapter 

type ManagerAdapter struct {
	// contains filtered or unexported fields
}

ManagerAdapter adapts different manager interfaces to the common Manager interface

func NewManagerAdapter 

func NewManagerAdapter(reportEventFunc func(eventType utils.EventType, event utils.K8sEvent)) *ManagerAdapter

NewManagerAdapter creates a new manager adapter

func (*ManagerAdapter) ReportEvent 

func (ma *ManagerAdapter) ReportEvent(eventType utils.EventType, event utils.K8sEvent)

ReportEvent implements the Manager interface

type OrderedEventQueue 

type OrderedEventQueue struct {
	// contains filtered or unexported fields
}

func NewOrderedEventQueue 

func NewOrderedEventQueue(collectionInterval time.Duration, maxBufferSize int) *OrderedEventQueue

func (*OrderedEventQueue) AddEventDirect 

func (oeq *OrderedEventQueue) AddEventDirect(eventType utils.EventType, event utils.K8sEvent, containerID string, processID uint32)

func (*OrderedEventQueue) DrainDropped added in v0.3.325 

func (oeq *OrderedEventQueue) DrainDropped(dst []DroppedEvents) []DroppedEvents

DrainDropped appends the drops recorded since the previous call to dst[:0] and resets the counters.

func (*OrderedEventQueue) Empty 

func (oeq *OrderedEventQueue) Empty() bool

Empty returns whether the queue is empty

func (*OrderedEventQueue) GetFullQueueAlertChannel 

func (oeq *OrderedEventQueue) GetFullQueueAlertChannel() <-chan struct{}

func (*OrderedEventQueue) PeekEvent 

func (oeq *OrderedEventQueue) PeekEvent() (EventEntry, bool)

func (*OrderedEventQueue) PopBatch added in v0.3.215 

func (oeq *OrderedEventQueue) PopBatch(maxCount int, dst []EventEntry) []EventEntry

func (*OrderedEventQueue) PopEvent 

func (oeq *OrderedEventQueue) PopEvent() (EventEntry, bool)

func (*OrderedEventQueue) Size 

func (oeq *OrderedEventQueue) Size() int

Size returns the number of events in the queue

type TracerManager 

type TracerManager struct {
	// contains filtered or unexported fields
}

TracerManager manages the lifecycle of all eBPF and custom tracers

Responsibilities: - Register and coordinate ~20 different tracers (exec, network, dns, http, etc.) - Stagger tracer startup to prevent concurrent eBPF loading (reduces peak RSS from 1.4GB to 500MB) - Handle graceful shutdown of all tracers

Key implementation detail: Tracers spawn goroutines in Start() for eBPF loading. Without controlled startup, all tracers load concurrently, causing kernel memory pressure.

func NewTracerManager 

func NewTracerManager(cfg config.Config, tracerFactory containerwatcher.TracerFactoryInterface) *TracerManager

func (*TracerManager) GetAllTracers 

func (tm *TracerManager) GetAllTracers() map[utils.EventType]containerwatcher.TracerInterface

func (*TracerManager) GetTracer 

func (tm *TracerManager) GetTracer(eventType utils.EventType) (containerwatcher.TracerInterface, bool)

func (*TracerManager) RegisterTracer 

func (tm *TracerManager) RegisterTracer(tracer containerwatcher.TracerInterface)

func (*TracerManager) StartAllTracers 

func (tm *TracerManager) StartAllTracers(ctx context.Context) error

StartAllTracers initializes and starts all tracers with staggered startup

Memory optimization strategy: Tracers load eBPF programs into kernel space via Inspektor Gadget. Without delays, all ~20 tracers call runtime.RunGadget() in a tight loop, causing concurrent bpf() syscalls. This results in peak RSS of ~1.4GB (kernel allocates separate regions for each tracer's eBPF programs/maps).

Adding delays between tracers allows sequential eBPF loading, reducing peak to ~500MB. The delay enables kernel to share BTF data and establish shared maps before the next tracer loads. Go heap memory remains unaffected (~100-180MB).

Delay value must exceed eBPF initialization time (~250-500ms per tracer). Current value of 2s ensures no overlap; 1s would also work per testing. 0ms or time.After(0) provides no benefit (equivalent to tight loop).

func (*TracerManager) StopAllTracers 

func (tm *TracerManager) StopAllTracers() error

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.