eBPF: Connecting with Container Runtimes

eBPF: Connecting with Container Runtimes

Objective

to understand how connection with Container Runtime (CR) is being made using Container Runtime Interface (CRI) in different open-source eBPF-based projects. to query pod or container info for context enrichment.

is being made using in different open-source eBPF-based projects.

Reasoning

Note Code snippets are take from open-source tetragon, tracee and crictl projects.

Connection with CR is important for making the tool/product kubernetes-aware. As it provides rich information that could be of interest for different use-cases.

Connection with CR involves following steps

locate unix-socket file

file make a grpc connection using CRI API

... continue reading