Re: unprivileged collection on containers

Hi, Mark -

> [...]  In the case of PCP, having systemd manage multiple services
> makes more sense and is likely the approach we would have taken if
> the choice was available back then. With one-container-per-service,
> we need bind mounts for all the important PCP directories (so they
> are shared by all PCP services in different containers), along with
> super-privileged access to all the namespaces (especially pid=host)
> - we ended up effectively running all PCP services on the host
> namespaces and filesystem [...]

FWIW, this is a peripheral point to my inquiry - it deals with how one
could package auxiliary pcp services (loggers etc.  in their own
containers, or not), whereas I was thinking solely about pmcd.  There,
the question is collection at the host (or host-equivalent SPC) versus
unprivileged containers.

In the former model, pmcd must jump into containers briefly to collect
their statistics.  In the latter, pmcd is already in each container of
interest and can report only its data: no jumping.  In the former,
software needs to be installed in the host and not needed in the
containers.  In the latter, vice versa.

In an ideal world, both would provide equivalent intra-container data
and vary only in terms of performance / deployability.  In the real
world, the host side pmcd jumps into containers inconsistently, so its
presentation of container metrics is not reliable.  Apparently, this
is NOTABUG (rhbz1378184).  That means that intra-container metrics are
currently only reliable if they come from a container-resident pmcd.


> Ok so that seems to work well, and is fine provided you're only
> interested in the pid namespace of the container rather than the
> entire system.

The theory there would be that one would run one unprivileged pmcds
inside each target container, and merge the results somewhere else.


- FChE

-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links:

You receive all messages sent to this group.

View/Reply Online (#15064): https://groups.io/g/pcp/message/15064
View All Messages In Topic (5): https://groups.io/g/pcp/topic/4296923
Mute This Topic: https://groups.io/mt/4296923?uid=174580
New Topic: https://groups.io/g/pcp/post
-=-=-
pcp mailing list
[email protected]
https://groups.io/g/pcp/messages
-=-=-
Change Your Subscription: https://groups.io/g/pcp/editsub?uid=174580
Group Home: https://groups.io/g/pcp
Contact Group Owner: [email protected]
Terms of Service: https://groups.io/static/tos
Unsubscribe: https://groups.io/g/pcp/leave/354243/563757577/xyzzy
-=-=-=-=-=-=-=-=-=-=-=-