Description

This tool is an experiment made to run runtime profiling on a container. The goal is to identify which files has been used given an image.

The technical approach is inspired from https://github.com/containers/oci-seccomp-bpf-hook.

It leverages OCI prestart hook with Podman to attach an eBPF program in the lsm/file_open to profile every opened file.

Installation

Prerequisites

• Linux kernel > 6.12
• Go 1.25+
• git
• Linux (root privileges required for the OCI hook / eBPF parts)
• Kernel with eBPF + LSM support enabled

Clone the repository

git clone https://github.com/axel7083/oci-hook-lsm-file-open
cd oci-hook-lsm-file-open

Configure

go mod download
make install

Usage

Once installed, you can use the custom annotation to trigger the OCI hook.

⚠️ because the OCI hook binary will load an eBPF program, it requires CAP_SYS_ADMIN, as it is called by podman, we need to run the all logic as root.

podman run --annotation="oci-demo-hook=$(pwd)/fedora.profiling.json" fedora

Report

The profiling result being a JSON dump, it is pretty hard to use. Leveraging bubbletea a TUI framework, we can use it to have a pretty nice experience to visualize the results.

The tool need 2 mandatory arguments

• --image: the image reference (E.g. fedora:latest) to use as reference
• --report: the report generated by the oci-hook binary

Debugging

If something is not working, you may use journalctl to debug the different binaries

There are 3 binaries created after running make install

1. oci-hook: this binary is called by podman when the proper annotation is specified
2. lsm-file-open: this binary is called by the oci-hook detached, it will load the eBPF program, then send SIGUSR1 to the parent process (oci-hook) to notify the eBPF program is ready.
3. report-generator: this binary is an utility tool to visualize the result of the runtime profiling.

See logs of the oci-hook

Depending on where it is installed, you can directly use the absolute path, by default after running make install it will be in ./bin folder of this repository.

journalctl -t $(pwd)/bin/oci-hook -f

Similar to oci-hook, we can see the logs of the lsm-file-open using journalctl.

journalctl -t $(pwd)/bin/lsm-file-open -f