aquasecurity / tracee

Linux Runtime Security and Forensics using eBPF
https://aquasecurity.github.io/tracee/latest
Apache License 2.0
3.39k stars 397 forks source link

Container Enrichment tests #1955

Open NDStrahilevitz opened 2 years ago

NDStrahilevitz commented 2 years ago

Prerequisites

Select one OR another:

Feature description

Container Enrichment's code is dependent on a lot of runtime variables and as such can't be easily (and possibly meaningfully) unit tested. Since breaking it is quite easy, there is a need for an integration test.

Additional Information (feature drawings, files, logs, etc)

Possible flow 1 (integration): Perquisite: add docker to the build-dependencies action Add the following integration test

  1. Create and run a tracee object tracing container_create events with enrichment enabled
  2. With the docker golang SDK loop container creations
  3. Compare number of loops with number of events (possibly with margin of error?)

Possible flow 2 (e2e)

  1. Build a tracee container
  2. Run tracee container with enrichment enabled tracing container_create
  3. Loop docker run --rm alpine commands
  4. Compare events to number of loop runs
itaysk commented 2 years ago

this integration test should consider containerd as well and possibly crio. it's fine to start with testing docker but please consider this as well in the design of the test