Sysdig, Inc.

Draios, Inc.

Gianluca Borello

Loris Degioanni

Luca Marturana

Techniques for dynamically instrumenting code to capture cleartext from transformed communications are provided. In one technique, an operating system (OS) mechanism receives an OS call. The OS mechanism determines whether the OS call is of a particular type. In response to determining that the OS call is of the particular type, a certain location within executable code of a unction is identified. A user-level collection mechanism is inserted at the certain location. After inserting the user-level collection mechanism, code at the certain location is executed that causes the user-level collection mechanism to be executed.

Dynamic instrumentation to capture cleartext from transformed communications

A computer-implemented method of monitoring programmatic containers (containers) through executing a computer program in a kernel space is disclosed. The method comprises storing trace data in a memory buffer that is shared by the kernel space and a user space, the trace data being related to execution of a process associated with a container at an execution point of the process. The method also comprises retrieving container data related to the container through raw access of one or more kernel data structures when execution of the process is stopped. In addition, the method comprises storing the container data in association with the trace data in the memory buffer.

Programmatic container monitoring

Techniques related to communication between independent containers are provided. In an embodiment, a first programmatic container includes one or more first namespaces in which an application program is executing. A second programmatic container includes one or more second namespaces in which a monitoring agent is executing. The one or more first namespaces are independent of the one or more second namespaces. A monitoring agent process hosts the monitoring agent. The monitoring agent is programmed to receive an identifier of the application program. The monitoring agent is further programmed to switch the monitoring agent process from the one or more second namespaces to the one or more first namespaces. After the switch, the monitoring agent process continues to execute in the second programmatic container, but communication is enabled between the application program and the monitoring agent via the monitoring agent process.

Communication between independent containers

A computer-implemented method comprises executing, in a first container of a first computer system, input source instructions; executing, using the same first computer system, a plurality of containerized application programs in different corresponding containers; monitoring, by the input source instructions, the one or more different containerized application programs by identifying one or more system calls that resulted from the different container applications generating statistical messages relating to operation of the containerized application programs; generating, by the input source instructions, one or more enriched messages based on the system calls that were identified and based on the statistical messages; transmitting the one or more enriched messages to a first metric collector, and aggregating a plurality of the enriched messages into a set of aggregated metrics values; sending, from the first metric collector to a monitoring application that is hosted on a second computer system, the aggregated metrics values.

Implicit push data transfer

A computer-implemented method of monitoring programmatic containers (containers) performed through executing a monitoring component in a user space is disclosed. The method comprises selecting, by a processor, one or more execution points from a plurality of execution points; causing, by the processor, a computer programs to be loaded into a virtual machine, the virtual machine verifying execution of the computer program before running the computer program in a kernel space; causing the computer program to be executed directly in the kernel space when execution of a process associated with one of a plurality of containers reaches the one execution point, each of the plurality of containers being associated with a distinct set of resources of a kernel of the kernel space, the computer program storing specific data in one or more memory buffers managed directly by the kernel and shared by the kernel space and the user space, the specific data including trace data related to execution of the process at the one execution point and container data related to the one container; receiving the specific data from the one or more memory buffers; causing a display of the container-specific trace data.

Growing community of inventors

Davis, CA, United States of America

Gianluca Borello