@@ -102,6 +102,7 @@ func NewContainerdHandler() *ContainerdHandler {
102102 // Subscribe to containerd events
103103
104104 // docker namespace
105+ ch .docker = context .Background ()
105106 ch .docker = namespaces .WithNamespace (context .Background (), "moby" )
106107
107108 dockerEventsCh , _ := client .EventService ().Subscribe (ch .docker , "" )
@@ -128,7 +129,7 @@ func (ch *ContainerdHandler) Close() {
128129// ==================== //
129130
130131// GetContainerInfo Function
131- func (ch * ContainerdHandler ) GetContainerInfo (ctx context.Context , containerID string , OwnerInfo map [string ]tp.PodOwner ) (tp.Container , error ) {
132+ func (ch * ContainerdHandler ) GetContainerInfo (ctx context.Context , containerID string , eventpid uint32 , OwnerInfo map [string ]tp.PodOwner ) (tp.Container , error ) {
132133 res , err := ch .client .ContainerService ().Get (ctx , containerID )
133134 if err != nil {
134135 return tp.Container {}, err
@@ -184,6 +185,36 @@ func (ch *ContainerdHandler) GetContainerInfo(ctx context.Context, containerID s
184185 }
185186
186187 // == //
188+ if eventpid == 0 {
189+ taskReq := task.ListPidsRequest {ContainerID : container .ContainerID }
190+ if taskRes , err := ch .client .TaskService ().ListPids (ctx , & taskReq ); err == nil {
191+ if len (taskRes .Processes ) == 0 {
192+ return container , err
193+ }
194+
195+ container .Pid = taskRes .Processes [0 ].Pid
196+
197+ } else {
198+ return container , err
199+ }
200+
201+ } else {
202+ container .Pid = eventpid
203+ }
204+
205+ pid := strconv .Itoa (int (container .Pid ))
206+
207+ if data , err := os .Readlink (filepath .Join (cfg .GlobalCfg .ProcFsMount , pid , "/ns/pid" )); err == nil {
208+ if _ , err := fmt .Sscanf (data , "pid:[%d]\n " , & container .PidNS ); err != nil {
209+ kg .Warnf ("Unable to get PidNS (%s, %s, %s)" , containerID , pid , err .Error ())
210+ }
211+ }
212+
213+ if data , err := os .Readlink (filepath .Join (cfg .GlobalCfg .ProcFsMount , pid , "/ns/mnt" )); err == nil {
214+ if _ , err := fmt .Sscanf (data , "mnt:[%d]\n " , & container .MntNS ); err != nil {
215+ kg .Warnf ("Unable to get MntNS (%s, %s, %s)" , containerID , pid , err .Error ())
216+ }
217+ }
187218
188219 taskReq := task.ListPidsRequest {ContainerID : container .ContainerID }
189220 if taskRes , err := ch .client .TaskService ().ListPids (ctx , & taskReq ); err == nil {
@@ -267,16 +298,20 @@ func (ch *ContainerdHandler) GetContainerdContainers() map[string]context.Contex
267298}
268299
269300// UpdateContainerdContainer Function
270- func (dm * KubeArmorDaemon ) UpdateContainerdContainer (ctx context.Context , containerID , action string ) bool {
301+ func (dm * KubeArmorDaemon ) UpdateContainerdContainer (ctx context.Context , containerID string , containerPid uint32 , action string ) bool {
271302 // check if Containerd exists
272303 if Containerd == nil {
273304 return false
274305 }
275306
276307 if action == "start" {
277308 // get container information from containerd client
278- container , err := Containerd .GetContainerInfo (ctx , containerID , dm .OwnerInfo )
309+ container , err := Containerd .GetContainerInfo (ctx , containerID , containerPid , dm .OwnerInfo )
279310 if err != nil {
311+ if strings .Contains (string (err .Error ()), "pause container" ) {
312+ kg .Debug (err .Error ())
313+ return false
314+ }
280315 kg .Err (err .Error ())
281316 return false
282317 }
@@ -554,7 +589,7 @@ func (dm *KubeArmorDaemon) MonitorContainerdEvents() {
554589
555590 if len (containers ) > 0 {
556591 for containerID , context := range containers {
557- if ! dm .UpdateContainerdContainer (context , containerID , "start" ) {
592+ if ! dm .UpdateContainerdContainer (context , containerID , 0 , "start" ) {
558593 continue
559594 }
560595 }
@@ -588,7 +623,7 @@ func (dm *KubeArmorDaemon) handleContainerdEvent(envelope *events.Envelope, cont
588623 if err != nil {
589624 kg .Errf ("failed to unmarshal container's delete event: %v" , err )
590625 }
591- dm .UpdateContainerdContainer (context , deleteContainer .GetID (), "destroy" )
626+ dm .UpdateContainerdContainer (context , deleteContainer .GetID (), 0 , "destroy" )
592627
593628 case "/tasks/start" :
594629 startTask := & apievents.TaskStart {}
@@ -597,7 +632,7 @@ func (dm *KubeArmorDaemon) handleContainerdEvent(envelope *events.Envelope, cont
597632 if err != nil {
598633 kg .Errf ("failed to unmarshal container's start task: %v" , err )
599634 }
600- dm .UpdateContainerdContainer (context , startTask .GetContainerID (), "start" )
635+ dm .UpdateContainerdContainer (context , startTask .GetContainerID (), startTask . GetPid (), "start" )
601636
602637 case "/tasks/exit" :
603638 exitTask := & apievents.TaskStart {}
@@ -612,7 +647,7 @@ func (dm *KubeArmorDaemon) handleContainerdEvent(envelope *events.Envelope, cont
612647 dm .ContainersLock .RUnlock ()
613648
614649 if pid == exitTask .GetPid () {
615- dm .UpdateContainerdContainer (context , exitTask .GetContainerID (), "destroy" )
650+ dm .UpdateContainerdContainer (context , exitTask .GetContainerID (), pid , "destroy" )
616651 }
617652
618653 }
0 commit comments