processmanager

Documentation

Index

• type ProcessManager
  • func CreateProcessManager(ctx context.Context) *ProcessManager
  • func (p *ProcessManager) ContainerCallback(notif containercollection.PubSubEvent)
  • func (p *ProcessManager) GetProcessTreeForPID(containerID string, pid int) (apitypes.Process, error)
  • func (p *ProcessManager) PopulateInitialProcesses() error
  • func (p *ProcessManager) ReportEvent(eventType utils.EventType, event utils.K8sEvent)

Types

type ProcessManager

type ProcessManager struct {
	// contains filtered or unexported fields
}

func CreateProcessManager

func CreateProcessManager(ctx context.Context) *ProcessManager

func (*ProcessManager) ContainerCallback

func (p *ProcessManager) ContainerCallback(notif containercollection.PubSubEvent)

ContainerCallback handles container lifecycle events (creation and removal). For new containers, it identifies the container's shim process and adds it to the tracking system. For removed containers, it cleans up the associated processes from the process tree.

func (*ProcessManager) GetProcessTreeForPID

func (p *ProcessManager) GetProcessTreeForPID(containerID string, pid int) (apitypes.Process, error)

GetProcessTreeForPID retrieves the process tree for a specific PID within a container. It returns the process and all its ancestors up to the container's shim process. If the process is not in the tree, it attempts to fetch it from /proc.

func (*ProcessManager) PopulateInitialProcesses

func (p *ProcessManager) PopulateInitialProcesses() error

PopulateInitialProcesses scans the /proc filesystem to build the initial process tree for all registered container shim processes. It establishes parent-child relationships between processes and adds them to the process tree if they are descendants of a shim.

func (*ProcessManager) ReportEvent

func (p *ProcessManager) ReportEvent(eventType utils.EventType, event utils.K8sEvent)

ReportEvent handles process execution events from the system. It specifically processes execve events to track new process creations and updates the process tree accordingly.