uprobetracer

Documentation

Overview

Package uprobetracer handles how uprobe/uretprobe programs are attached to containers. It has two running modes: `pending` mode and `running` mode.

Before `AttachProg` is called, uprobetracer runs in `pending` mode, only maintaining the container PIDs ready to attach to.

When `AttachProg` is called, uprobetracer enters the `running` mode and attaches to all pending containers. After that, it will never get back to the `pending` mode.

In `running` mode, uprobetracer holds fd(s) of the executables, so we can use `/proc/self/fd/$fd` for attaching, it is used to avoid fd-reusing.

Uprobetracer doesn't maintain ebpf.collection or perf-ring buffer by itself, those are hold by the parent tracer.

All interfaces should hold locks, while inner functions do not.

Index

• type ProgType
• type Tracer
  • func NewTracer[Event any](logger logger.Logger) (*Tracer[Event], error)
  • func (t *Tracer[Event]) AttachContainer(container *containercollection.Container) error
  • func (t *Tracer[Event]) AttachProg(progName string, progType ProgType, attachTo string, prog *ebpf.Program) error
  • func (t *Tracer[Event]) Close()
  • func (t *Tracer[Event]) DetachContainer(container *containercollection.Container) error

Types

type ProgType

type ProgType uint32

const (
	ProgUprobe ProgType = iota
	ProgUretprobe
)

type Tracer

type Tracer[Event any] struct {
	// contains filtered or unexported fields
}

func NewTracer

func NewTracer[Event any](logger logger.Logger) (*Tracer[Event], error)

func (*Tracer[Event]) AttachContainer

func (t *Tracer[Event]) AttachContainer(container *containercollection.Container) error

AttachContainer will attach now if the prog is ready, otherwise it will add container into the pending list

func (*Tracer[Event]) AttachProg

func (t *Tracer[Event]) AttachProg(progName string, progType ProgType, attachTo string, prog *ebpf.Program) error

AttachProg loads the ebpf program, and try attaching if there are pending containers

func (*Tracer[Event]) Close

func (t *Tracer[Event]) Close()

func (*Tracer[Event]) DetachContainer

func (t *Tracer[Event]) DetachContainer(container *containercollection.Container) error