Documentation
¶
Overview ¶
Package uprobetracer handles how uprobe/uretprobe programs are attached to containers. It has two running modes: `pending` mode and `running` mode.
Before `AttachProg` is called, uprobetracer runs in `pending` mode, only maintaining the container PIDs ready to attach to.
When `AttachProg` is called, uprobetracer enters the `running` mode and attaches to all pending containers. After that, it will never get back to the `pending` mode.
In `running` mode, uprobetracer holds fd(s) of the executables, so we can use `/proc/self/fd/$fd` for attaching, it is used to avoid fd-reusing.
Uprobetracer doesn't maintain ebpf.collection or perf-ring buffer by itself, those are hold by the parent tracer.
All interfaces should hold locks, while inner functions do not.
Index ¶
- type ProgType
- type Tracer
- func (t *Tracer[Event]) AttachContainer(container *containercollection.Container) error
- func (t *Tracer[Event]) AttachProg(progName string, progType ProgType, attachTo string, prog *ebpf.Program) error
- func (t *Tracer[Event]) Close()
- func (t *Tracer[Event]) DetachContainer(container *containercollection.Container) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Tracer ¶
type Tracer[Event any] struct { // contains filtered or unexported fields }
func (*Tracer[Event]) AttachContainer ¶
func (t *Tracer[Event]) AttachContainer(container *containercollection.Container) error
AttachContainer will attach now if the prog is ready, otherwise it will add container into the pending list
func (*Tracer[Event]) AttachProg ¶
func (t *Tracer[Event]) AttachProg(progName string, progType ProgType, attachTo string, prog *ebpf.Program) error
AttachProg loads the ebpf program, and try attaching if there are pending containers
func (*Tracer[Event]) DetachContainer ¶
func (t *Tracer[Event]) DetachContainer(container *containercollection.Container) error
Source Files