Ability to use sysdig inside openvz/lxc/docker containers

[pavel-odintsov]

Hello!

sysdig perfectly work on server with many containers but it's very useful provide ability to run it inside container from container customer.

It did not work now (I checked it for OpenVZ containers):
sysdig
error opening device /dev/sysdig0. Make sure you have root credentials and that the sysdig-probe module is loaded.

But on hardware server sysdig module work fine.

[gianlucaborello]

Thanks for reporting this, unfortunately if you try sysdig inside a container you're going into a "hostile territory" mainly because none of us developers has ever had time to test it there, so it will likely break for one reason or another.

What I can tell you is that container support is in our todo list so at some point will be fixed according to the roadmap, but until then you should just use it outside the container, or troubleshoot the issue yourself and submit a patch :)

[kristopolous]

I run it in virtualbox all the time (on multiple variations of linux and solaris), we've done it in QEMU on various architectures, and I've run it on the Xen hypervisor. I realize these are all different than the JAILS-like system you are talking about, but perhaps that solution will work for you?

If you want a working vagrant config than you can find one in this branch: https://github.com/kristopolous/sysdig/tree/chris-vagrant ... otherwise I'll see if I can try this myself sometime this week.

[rkoster]

I'm also running into this issue while running on bosh-lite which is using warden as a container technology.
After following the manual installation instructions the binary was available on the system. But got the error from above while the sysdig kernel module was loaded.

> sysdig
error opening device /dev/sysdig0. Make sure you have root credentials and that the sysdig-probe module is loaded.
> lsmod | grep sysdig
sysdig_probe          234309  0

[gianlucaborello]

can you do ls /dev/sysdig*? Also, were you running sysdig as root or with sudo? And, does the container have the privilege to access files under /dev?

[pavel-odintsov]

Hello!

I tried to pass sysdig devices to openvz container:

for i in `seq 0 10`;do vzctl set 1204 --devnodes sysdig$i:rw --save;done

After this I enter to CT:

 vzctl enter 1204
entered into CT 1204

And check this devices in it:

ls -al /dev/sysdig*
crw-r----- 1 root root 246,  0 Sep  9 14:27 /dev/sysdig0
crw-r----- 1 root root 246,  1 Sep  9 14:27 /dev/sysdig1
crw-r----- 1 root root 246, 10 Sep  9 14:27 /dev/sysdig10
crw-r----- 1 root root 246,  2 Sep  9 14:27 /dev/sysdig2
crw-r----- 1 root root 246,  3 Sep  9 14:27 /dev/sysdig3
crw-r----- 1 root root 246,  4 Sep  9 14:27 /dev/sysdig4
crw-r----- 1 root root 246,  5 Sep  9 14:27 /dev/sysdig5
crw-r----- 1 root root 246,  6 Sep  9 14:27 /dev/sysdig6
crw-r----- 1 root root 246,  7 Sep  9 14:27 /dev/sysdig7
crw-r----- 1 root root 246,  8 Sep  9 14:27 /dev/sysdig8
crw-r----- 1 root root 246,  9 Sep  9 14:27 /dev/sysdig9

And when I run installer:

curl -s https://s3.amazonaws.com/download.draios.com/stable/install-sysdig | sudo bash

It tried to install kernel and build modules but it's useless in LXC or OpenVZ container. You should fix installer.

And when I run sysdig I got events filtered only for certain container, everything works fine.

But when I have runned sysdig in container I can't run it on hardware node:

device /dev/sysdig0 is already open. You can't run multiple instances of sysdig.

[shawnholt]

Unfortunately, no way to get it to work inside an OpenVZ container :(

[azharz]

Too many sysdig instances attached to device /dev/sysdig0. Current value for /sys/module/sysdig_probe/parameters/max_consumers is '5'.

what should i do

[ChanderG]

Slightly tangential to this thread, but if people end up here with the same problem that @azharz has faced, this is the solution:

1. Unload the sysdig_probe module: sudo modprobe -r sysdig_probe.
2. Load the module with the parameter specified, eg: sudo modprobe sysdig_probe max_consumers=10.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.