Re: unprivileged collection on containers

----- Original Message -----
> 
> In online-hosted land, there is sometimes a need to collect data from
> within a container about processes in itself and (as much as visible)
> about the host.  On these systems, there is no opportunity to install
> privileged software such as pmcd (not just without docker
> --privileged; no intra-container root either) on the host, so the
> ambitious agent-less container capabilities of pcp are moot.
> 
> One can imagine a pmcd mode that starts up without root.  No pmdaroot
> of course, nor any setuid-capable pmda*.  All the needed pmdas would
> run as the native uid of the container, and would necessarily expose
> only local-perspective state.
> 

If I follow what you're asking for, I don't think there's much change
needed in PCP to make this happen (ignoring the uncertainty about how
this data will be subsequently consumed - first things first).

I assume we are talking about containers with applications running in
them, and those apps are the processes of interest you've referred to
in your first sentence.  Which means we need some kind of init system
in the container if pmcd is going to be running alongside the app, so
that means (most likely) a systemd-based container.

I set about finding out whether or not this works already.  Refer to
the attached Dockerfile, based on Dan Walsh's systemd+httpd blog post
https://developers.redhat.com/blog/2016/09/13/running-systemd-in-a-non-privileged-container/

Looks like it should work out-of-the-box.  Application instrumentation
is available with the MMV PMDA there too, at no extra cost.

I've setup the Dockerfile to present pmcd only via unix-domain socket,
to avoid the port-numbering issues, but the container could expose the
pmcd port (44321) alongside Apache (80) quite easily too - the naming
is more clear using filesystem paths over port numbers.

# pminfo -h unix:/run/containers/httpd/pcp/pmcd.socket -f proc.memory.rss

proc.memory.rss
    inst [1 or "000001 /sbin/init"] value 5120
    inst [27 or "000027 /usr/lib/systemd/systemd-journald"] value 6512
    inst [39 or "000039 /usr/bin/dbus-daemon"] value 3768
    inst [41 or "000041 /usr/sbin/httpd"] value 9996
    inst [110 or "000110 /usr/sbin/httpd"] value 7376
    inst [111 or "000111 /usr/sbin/httpd"] value 7376
    inst [115 or "000115 /usr/sbin/httpd"] value 7376
    inst [120 or "000120 /usr/sbin/httpd"] value 7376
    inst [139 or "000139 /usr/sbin/httpd"] value 7376
    inst [149 or "000149 /usr/libexec/pcp/bin/pmcd"] value 5216

> If someone were to need this in a hurry, what would you say?

I'd say resourcing and scheduling of Red Hat projects are more suited
to internal discussion, not public lists like this one.

In terms of PCP community relevance though, I'd say (assuming Mark/anyone
else sees no issues) we could add a "pcp-standalone" container into our
current set, separating out PCP related configuration from the Apache stuff
in the Dockerfile attached, adding Parfait and UoM for some examples beyond
Apache, and that could be shipped on bintray... thoughts Mark?

cheers.

--
Nathan

-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links:

You receive all messages sent to this group.

View/Reply Online (#15058): https://groups.io/g/pcp/message/15058
View All Messages In Topic (2): https://groups.io/g/pcp/topic/4296923
Mute This Topic: https://groups.io/mt/4296923?uid=174580
New Topic: https://groups.io/g/pcp/post
-=-=-
pcp mailing list
[email protected]
https://groups.io/g/pcp/messages
-=-=-
Change Your Subscription: https://groups.io/g/pcp/editsub?uid=174580
Group Home: https://groups.io/g/pcp
Contact Group Owner: [email protected]
Terms of Service: https://groups.io/static/tos
Unsubscribe: https://groups.io/g/pcp/leave/354243/563757577/xyzzy
-=-=-=-=-=-=-=-=-=-=-=-