tracee-ebpf: mount event missing source field

Hi, I'm using tracee-ebpf to collect mount events. However, the "source" field misses sometimes.

Here is an example (you can start a docker container a few times and see this scenario):

Also, you can notice that the "filesystem type" is also missing sometimes. The example shows that LTTng gives mount type "bind", while tracee gives nothing.

{
  "processName":"runc:2:INIT]",
  "containerId":"2af0bc626525",
  "eventId":"165",
  "eventName":"mount",
  "argsNum":3,
  "returnValue":0,
  "args":[{ 
    "name":"target",
    "type":"const char*",
"value":"/var/lib/docker/overlay2/6fd16b36923947538d76e6b781d08f08d64ac69f513e7b24a889fa4337a948e0/merged/etc/resolv.conf"
  },{
    "name":"mountflags",
    "type":"unsigned long",
    "value":278528
  },{
    "name":"data",
    "type":"const void*",
    "value":0}
]}

As a comparison, LTTng will output this event as:

{
  "pid_ns":4026532645,
  "vtid":1,
  "event":"mount",
  "comm":"runc:[2:INIT]",
  "args":[{
    "Name":"dev_name",
    "Value":"/sys/fs/cgroup/devices/docker/2af0bc6265257c960d559b38134bf212b3292f226c586dd9295b42faa2945df7"
  },{
    "Name":"dir_name",
"Value":"/var/lib/docker/overlay2/6fd16b36923947538d76e6b781d08f08d64ac69f513e7b24a889fa4337a948e0/merged/etc/resolv.conf"
  },{
    "Name":"type","Value":"bind"
  },{
    "Name":"flags","Value":"278528"
  }],
  "tid":220199
}

@SericaLaw mind sharing some other details like:

host kernel / distribution / version
tracee cmdline (and if you're using CO-RE or not)

Thanks

@rafaeldtinoco Hi, the output of uname -a is:

Linux ubuntu 5.11.0-27-generic #29~20.04.1-Ubuntu SMP Wed Aug 11 15:58:17 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

The command line:

sudo ./tracee-ebpf --output json --trace event=mount > tracee.json

I use ubuntu 20.04. Also, I compile tracee v0.6.0 with docker, so I'm not sure if it use CO-RE. But I think it's not because this kernel does not have btf tools to generate headers.

Btw, not all the mount outputs are missing fields, most output are correct, e.g.:

{
  "processName":"runc:[2:INIT]",
  "containerId":"2af0bc626525",
  "eventId":"165",
  "eventName":"mount",
  "argsNum":5,
  "returnValue":0,
  "args":[{
    "name":"source",
    "type":"const char*",
    "value":"/var/lib/docker/containers/2af0bc6265257c960d559b38134bf212b3292f226c586dd9295b42faa2945df7/hosts"
  },{
    "name":"target",
    "type":"const char*",
"value":"/var/lib/docker/overlay2/6fd16b36923947538d76e6b781d08f08d64ac69f513e7b24a889fa4337a948e0/merged/etc/hosts"  
  },{
    "name":"filesystemtype",
    "type":"const char*",
    "value":"bind"
  },{
    "name":"mountflags",
    "type":"unsigned long",
    "value":20480
  },{
    "name":"data",
    "type":"const void*",
    "value":0}
]}

Just a guess, maybe the string length is too long?

I need to differentiate your execution environment. Just a few more questions...

Could you check your ./dist/ directory (from the git tree, after the build):

$ ls dist
libbpf  tracee-ebpf  tracee.bpf  tracee.bpf.5_11_0-31-generic.v0_6_0-49-g61addf9.o  tracee.bpf.core.o

and check if by using the non CO-RE version it also happens ?

You can do that by executing:

CO-RE

$ sudo ./dist/tracee-ebpf --debug --trace event=mount
BTF: bpfenv = false, btfenv = false, vmlinux = true
BPF: using embedded BPF object
unpacked CO:RE bpf object file into memory
TIME             UID    COMM             PID     TID     RET              EVENT                ARGS
Running container = vice/app.slice/snap.lxd.lxc.4b3296a2-c139-4da5-b782-006c431cca74 pid = 2558259
2021-08-26 02:20:01.54532799 -0300 -03  Xvnc-core         604317   debug_net/udp_sendmsg          LocalIP: 0.0.0.0, LocalPort: 5901, Protocol: 17

non CO-RE:

$ sudo TRACEE_BPF_FILE=./dist/tracee.bpf.5_11_0-31-generic.v0_6_0-49-g61addf9.o ./dist/tracee-ebpf --debug --trace event=mount
BTF: bpfenv = true, btfenv = false, vmlinux = true
BPF: using BPF object from environment: ./dist/tracee.bpf.5_11_0-31-generic.v0_6_0-49-g61addf9.o
TIME             UID    COMM             PID     TID     RET              EVENT                ARGS
Running container = vice/app.slice/snap.lxd.lxc.4b3296a2-c139-4da5-b782-006c431cca74 pid = 2558259
2021-08-26 02:20:22.571814373 -0300 -03  Xvnc-core         604317   debug_net/udp_sendmsg          LocalIP: 0.0.0.0, LocalPort: 5901, Protocol: 17

Note: you have to change TRACEE_BPF_FILE to point to your specific .o file inside ./dist/ directory.

@rafaeldtinoco Here is the content of ./dist:

libbpf  tracee.bpf  tracee.bpf.5_11_0-25-generic.v0_6_0-35-g5a0eb2d.o  tracee.bpf.core.o  tracee-builder  tracee-ebpf

And if I run without assigning TRACEE_BPF_FILE, the output is like:

BTF: bpfenv = false, btfenv = false, vmlinux = false
BPF: no BTF file was found or provided, building BPF object
found bpf object file at: /tmp/tracee/tracee.bpf.5_11_0-27-generic.v0_6_0-35-g5a0eb2d.o

so it's not CO-RE.

I started the docker again with TRACEE_BPF_FILE env provided, the scenario was reproduced again. Sometimes the mount has 4 args, sometimes just 3.

@SericaLaw can you please try to run tracee with: -t e=mount,security_sb_mount? The security_sb_mount is an internal kernel function, and should provide the source and dest arguments as well. I want to know if this missing argument happens for this event too.

@yanivagman the security_sb_mount gives 4 args, but there are empty strings:

{"processName":"runc:[2:INIT]","containerId":"a5d6e5bf90f2","eventId":"1022","eventName":"security_sb_mount","argsNum":4,"returnValue":0,"args":[{"name":"dev_name","type":"const char*","value":""},{"name":"path","type":"const char*","value":"/var/lib/docker/overlay2/d3ccce5b3e33fce6f2cd041d06db6f9c9e89497e1cd31e4fe06fa56a8c730b2d/merged/etc/hosts"},{"name":"type","type":"const char*","value":""},{"name":"flags","type":"unsigned long","value":278528}]}

{"processName":"runc:[2:INIT]","containerId":"a5d6e5bf90f2","eventId":"165","eventName":"mount","argsNum":3,"returnValue":0,"args":[{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/d3ccce5b3e33fce6f2cd041d06db6f9c9e89497e1cd31e4fe06fa56a8c730b2d/merged/etc/hosts"},{"name":"mountflags","type":"unsigned long","value":278528},{"name":"data","type":"const void*","value":0}]}

The corresponding LTTng output:

{"eventname": "syscall_entry_mount", "procname": "runc:[2:INIT]", "payload": [{"name": "dev_name", "value": "/sys/fs/cgroup/devices/docker/a5d6e5bf90f2e4e9163b2e73ada542458f13fb000e84c2ef4dae95a6bad39aac"}, {"name": "dir_name", "value": "/var/lib/docker/overlay2/d3ccce5b3e33fce6f2cd041d06db6f9c9e89497e1cd31e4fe06fa56a8c730b2d/merged/etc/hosts"}, {"name": "type", "value": "bind"}, {"name": "flags", "value": "278528"}, {"name": "data", "value": "0"}], "cpu_id": "2"}

I'm able to reproduce this on 5.13 kernel (fedora 33) with the CORE binary.

A couple observations while looking into this:

Strace has the same behavior as Tracee, 'source' is missing for the same events
@SericaLaw, in the LTTng examples you provide I think the 'flags' arguments mean that the source argument is ignored [1]. I'm not familiar with LTTng, but perhaps in the mechanisms that tracee and strace use, the argument is optimized out.

[1] For example: 278528 = MS_REC|MS_SLAVE, according to the man page for mount, changing the propagation type of an existing mount means the source, fstype and data arguments are ignored.

@yanivagman can you again describe your theory for what could be causing this? I believe you thought it had to do around overlay filesystems?

@grantseltzer I have no specific theory but as this problem was seen in the runc:init process (thus should be reproducible by running an arbitrary container), I thought that possible directions to investigate would be mount namespaces and overlay fs.

Yes, some mount/security_sb_mount events have empty 'dev_name' for 'exe' and 'runc' processes:

$ sudo ./dist/tracee-ebpf --trace event=mount --output option:detect-syscall
TIME             UID    COMM             PID     TID     RET              EVENT                ARGS
14:29:24:539477  0      dockerd          2487798 2487953 0                mount                source: overlay, target: /var/lib/docker/overlay2/36a2786d96080b6857b34e4422f849959282d3045ea769475a1f7c41612f25a1-init/merged, filesystemtype: overlay, mountflags: 0, data: 0xC000D7C140
14:29:24:567992  0      dockerd          2487798 2487953 0                mount                source: overlay, target: /var/lib/docker/overlay2/36a2786d96080b6857b34e4422f849959282d3045ea769475a1f7c41612f25a1/merged, filesystemtype: overlay, mountflags: 0, data: 0xC000142F20
14:29:24:628470  0      dockerd          2487798 2487806 0                mount                source: overlay, target: /var/lib/docker/overlay2/36a2786d96080b6857b34e4422f849959282d3045ea769475a1f7c41612f25a1/merged, filesystemtype: overlay, mountflags: 0, data: 0xC0003B2420
14:29:24:812318  0      exe              2597968 2597968 0                mount                source: /proc/self/exe, target: /var/run/docker/runtime-runc/moby/6e5cc02892e7cc270dc06f391eb25aa53a3f4ccdd7e5fbf066551ec4600d71d6/runc.x0m4C7, mountflags: 4096, data: 0x5565294B3A15
14:29:24:812655  0      exe              2597968 2597968 0                mount                target: /var/run/docker/runtime-runc/moby/6e5cc02892e7cc270dc06f391eb25aa53a3f4ccdd7e5fbf066551ec4600d71d6/runc.x0m4C7, mountflags: 4129, data: 0x5565294B3A15
14:29:24:862415  0      runc:[2:INIT]    1       1       0                mount                target: /, mountflags: 540672, data: 0x0
14:29:24:862763  0      runc:[2:INIT]    1       1       0                mount                source: /var/lib/docker/overlay2/36a2786d96080b6857b34e4422f849959282d3045ea769475a1f7c41612f25a1/merged, target: /var/lib/docker/overlay2/36a2786d96080b6857b34e4422f849959282d3045ea769475a1f7c41612f25a1/merged, filesystemtype: bind, mountflags: 20480, data: 0x0
14:29:24:862907  0      runc:[2:INIT]    1       1       0                mount                source: proc, target: /proc/self/fd/7, filesystemtype: proc, mountflags: 14, data: 0x0
14:29:24:863186  0      runc:[2:INIT]    1       1       0                mount                source: tmpfs, target: /proc/self/fd/7, filesystemtype: tmpfs, mountflags: 16777218, data: 0xC00021ABE0
14:29:24:863512  0      runc:[2:INIT]    1       1       0                mount                source: devpts, target: /proc/self/fd/7, filesystemtype: devpts, mountflags: 10, data: 0xC000124510
14:29:24:863783  0      runc:[2:INIT]    1       1       0                mount                source: sysfs, target: /proc/self/fd/7, filesystemtype: sysfs, mountflags: 14, data: 0x0
14:29:24:864528  0      runc:[2:INIT]    1       1       0                mount                source: tmpfs, target: /proc/self/fd/7, filesystemtype: tmpfs, mountflags: 14, data: 0xC0001BD630

and

$ sudo ./dist/tracee-ebpf --trace event=security_sb_mount --output option:detect-syscall
TIME             UID    COMM             PID     TID     RET              EVENT                ARGS
14:36:37:516245  0      dockerd          2487798 2487800 0                security_sb_mount    dev_name: overlay, path: /var/lib/docker/overlay2/a0c52813d0208ef9a7a2931d9f3d1c747968123b651e4703065072a71f3143b3-init/merged, type: overlay, flags: 0
14:36:37:542121  0      dockerd          2487798 2487800 0                security_sb_mount    dev_name: overlay, path: /var/lib/docker/overlay2/a0c52813d0208ef9a7a2931d9f3d1c747968123b651e4703065072a71f3143b3/merged, type: overlay, flags: 0
14:36:37:560438  0      dockerd          2487798 2487812 0                security_sb_mount    dev_name: overlay, path: /var/lib/docker/overlay2/a0c52813d0208ef9a7a2931d9f3d1c747968123b651e4703065072a71f3143b3/merged, type: overlay, flags: 0
14:36:37:735867  0      exe              2664328 2664328 0                security_sb_mount    dev_name: /proc/self/exe, path: /run/docker/runtime-runc/moby/4ce2a784d2106062ffb755135d5d04e7c09a9bb4820f6d58a841c253841c9603/runc.i5PgB9, type: , flags: 4096
14:36:37:736189  0      exe              2664328 2664328 0                security_sb_mount    dev_name: , path: /run/docker/runtime-runc/moby/4ce2a784d2106062ffb755135d5d04e7c09a9bb4820f6d58a841c253841c9603/runc.i5PgB9, type: , flags: 4129
14:36:37:795880  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: , path: /, type: , flags: 540672
14:36:37:796272  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /var/lib/docker/overlay2/a0c52813d0208ef9a7a2931d9f3d1c747968123b651e4703065072a71f3143b3/merged, path: /var/lib/docker/overlay2/a0c52813d0208ef9a7a2931d9f3d1c747968123b651e4703065072a71f3143b3/merged, type: bind, flags: 20480
14:36:37:796408  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: proc, path: /var/lib/docker/overlay2/a0c52813d0208ef9a7a2931d9f3d1c747968123b651e4703065072a71f3143b3/merged/proc, type: proc, flags: 14
14:36:37:796673  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: tmpfs, path: /var/lib/docker/overlay2/a0c52813d0208ef9a7a2931d9f3d1c747968123b651e4703065072a71f3143b3/merged/dev, type: tmpfs, flags: 16777218
14:36:37:796996  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: devpts, path: /var/lib/docker/overlay2/a0c52813d0208ef9a7a2931d9f3d1c747968123b651e4703065072a71f3143b3/merged/dev/pts, type: devpts, flags: 10
14:36:37:797266  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: sysfs, path: /var/lib/docker/overlay2/a0c52813d0208ef9a7a2931d9f3d1c747968123b651e4703065072a71f3143b3/merged/sys, type: sysfs, flags: 14
14:36:37:798059  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: tmpfs, path: /var/lib/docker/overlay2/a0c52813d0208ef9a7a2931d9f3d1c747968123b651e4703065072a71f3143b3/merged/sys/fs/cgroup, type: tmpfs, flags: 14

And by capturing manually from a scratch program:

(2021/10/08_15:27) dockerd (pid: 2487798) (loginuid: -1): arg: overlay
(2021/10/08_15:27) dockerd (pid: 2487798) (loginuid: -1): arg: overlay
(2021/10/08_15:27) dockerd (pid: 2487798) (loginuid: -1): arg: overlay
(2021/10/08_15:27) exe (pid: 3141165) (loginuid: -1): arg: /proc/self/exe
(2021/10/08_15:27) exe (pid: 3141165) (loginuid: -1): arg:
(2021/10/08_15:27) runc:[2:INIT] (pid: 3141169) (loginuid: -1): arg:
(2021/10/08_15:27) runc:[2:INIT] (pid: 3141169) (loginuid: -1): arg: /var/lib/docker
(2021/10/08_15:27) runc:[2:INIT] (pid: 3141169) (loginuid: -1): arg: proc
(2021/10/08_15:27) runc:[2:INIT] (pid: 3141169) (loginuid: -1): arg: tmpfs
(2021/10/08_15:27) runc:[2:INIT] (pid: 3141169) (loginuid: -1): arg: devpts
(2021/10/08_15:27) runc:[2:INIT] (pid: 3141169) (loginuid: -1): arg: sysfs
(2021/10/08_15:27) runc:[2:INIT] (pid: 3141169) (loginuid: -1): arg: tmpfs

Looks like bpftrace does not support printing the backtrace like systemtap does:

$ bpftrace -e 'kprobe:security_sb_mount { $dev_name = arg0; printf("%s\n", str($dev_name)); }'
Attaching 1 probe...
overlay
overlay
overlay
/proc/self/exe

/var/lib/docker/overlay2/3f4609411822008fae55e194d0e453f16377d7
proc
tmpfs
devpts
sysfs
tmpfs

Let me get the kernel stack trace when dev_name is not populated (by using systemtap)...

By checking the backtrace when dev_name is empty with stap script:

#!/usr/bin/env stap

probe begin {
    printf("Ready!\n");
}

probe kernel.function("security_sb_mount")
{
    dname = kernel_string($dev_name);
    if (strlen(dname) < 1) {
        printf("program = %s (pid = %d, dev_name = %s)\n", execname(), pid(), dname);
        print_backtrace();
    }
}

$ sudo ./temp.stap
Ready!
program = exe (pid = 3586473, dev_name = )
 0xffffffffb3ec9640 : security_sb_mount+0x0/0x70 [kernel]
 0xffffffffb3d4e090 : path_mount+0x80/0x4e0 [kernel]
 0xffffffffb3d4e5f8 : __x64_sys_mount+0x108/0x140 [kernel]
 0xffffffffb4638d28 : do_syscall_64+0x38/0x90 [kernel]
 0xffffffffb480008c : entry_SYSCALL_64_after_hwframe+0x44/0xa9 [kernel]
 0xffffffffb480008c : entry_SYSCALL_64_after_hwframe+0x44/0xa9 [kernel]
program = runc:[2:INIT] (pid = 3586476, dev_name = )
 0xffffffffb3ec9640 : security_sb_mount+0x0/0x70 [kernel]
 0xffffffffb3d4e090 : path_mount+0x80/0x4e0 [kernel]
 0xffffffffb3d4e5f8 : __x64_sys_mount+0x108/0x140 [kernel]
 0xffffffffb4638d28 : do_syscall_64+0x38/0x90 [kernel]
 0xffffffffb480008c : entry_SYSCALL_64_after_hwframe+0x44/0xa9 [kernel]
 0xffffffffb480008c : entry_SYSCALL_64_after_hwframe+0x44/0xa9 [kernel]

we see that execution trace is:

do_sys_mount -> do_mount -> path_mount -> security_sb_mount

and the 1st argument (dev_name) is given by the userland:

    kernel_dev = copy_mount_string(dev_name);
    ret = PTR_ERR(kernel_dev);
    if (IS_ERR(kernel_dev))
        goto out_dev;

and it is not NULL (it is really empty).

@SericaLaw

If I trace the EXACT same events with LTTNG:

# babeltrace lttng-traces/auto-20211008-172757 2>&1 | grep syscall_entry_mount

[17:28:14.302082868] (+?.?????????) fujitsu syscall_entry_mount: { cpu_id = 23 }, { dev_name = "overlay", dir_name = "/var/lib/docker/overlay2/cf5308f4c2e4ebee1d30513494ee905fcd85e7065c12b25bfe96fe4b45a750e0-init/merged", type = "overlay", flags = 0, data = 824635902144 }
[17:28:14.330536490] (+0.027790997) fujitsu syscall_entry_mount: { cpu_id = 7 }, { dev_name = "overlay", dir_name = "/var/lib/docker/overlay2/cf5308f4c2e4ebee1d30513494ee905fcd85e7065c12b25bfe96fe4b45a750e0/merged", type = "overlay", flags = 0, data = 824635043264 }
[17:28:14.345871026] (+0.014766256) fujitsu syscall_entry_mount: { cpu_id = 3 }, { dev_name = "overlay", dir_name = "/var/lib/docker/overlay2/cf5308f4c2e4ebee1d30513494ee905fcd85e7065c12b25bfe96fe4b45a750e0/merged", type = "overlay", flags = 0, data = 824637596704 }
[17:28:14.538214863] (+0.191562155) fujitsu syscall_entry_mount: { cpu_id = 5 }, { dev_name = "/proc/self/exe", dir_name = "/var/run/docker/runtime-runc/moby/72060501b35c61c2a10707b3485251118f4fb27f0e5c18d34ab8113426fd0950/runc.WD0ifw", type = "", flags = 4096, data = 94328070232597 }
[17:28:14.538546824] (+0.000006566) fujitsu syscall_entry_mount: { cpu_id = 5 }, { dev_name = "", dir_name = "/var/run/docker/runtime-runc/moby/72060501b35c61c2a10707b3485251118f4fb27f0e5c18d34ab8113426fd0950/runc.WD0ifw", type = "", flags = 4129, data = 94328070232597 }
[17:28:14.574006630] (+0.035436818) fujitsu syscall_entry_mount: { cpu_id = 15 }, { dev_name = "", dir_name = "/", type = "", flags = 540672, data = 0 }
[17:28:14.574428710] (+0.000395650) fujitsu syscall_entry_mount: { cpu_id = 15 }, { dev_name = "/var/lib/docker/overlay2/cf5308f4c2e4ebee1d30513494ee905fcd85e7065c12b25bfe96fe4b45a750e0/merged", dir_name = "/var/lib/docker/overlay2/cf5308f4c2e4ebee1d30513494ee905fcd85e7065c12b25bfe96fe4b45a750e0/merged", type = "bind", flags = 20480, data = 0 }
[17:28:14.574548586] (+0.000095338) fujitsu syscall_entry_mount: { cpu_id = 15 }, { dev_name = "proc", dir_name = "/proc/self/fd/7", type = "proc", flags = 14, data = 0 }
[17:28:14.574816811] (+0.000109467) fujitsu syscall_entry_mount: { cpu_id = 15 }, { dev_name = "tmpfs", dir_name = "/proc/self/fd/7", type = "tmpfs", flags = 16777218, data = 824634420224 }
[17:28:14.575112672] (+0.000154939) fujitsu syscall_entry_mount: { cpu_id = 15 }, { dev_name = "devpts", dir_name = "/proc/self/fd/7", type = "devpts", flags = 10, data = 824634918352 }
[17:28:14.575358151] (+0.000102051) fujitsu syscall_entry_mount: { cpu_id = 15 }, { dev_name = "sysfs", dir_name = "/proc/self/fd/7", type = "sysfs", flags = 14, data = 0 }
[17:28:14.576185182] (+0.000684387) fujitsu syscall_entry_mount: { cpu_id = 15 }, { dev_name = "tmpfs", dir_name = "/proc/self/fd/7", type = "tmpfs", flags = 14, data = 824634447424 }

You will see that there are missing "dev_names" from lttng tool as well. Perhaps you are mixing the events on your side ? By tracing "security_sb_mount" event you will get the same behavior as the one from lttng tool (as showed here).

If this is in fact a bug or requires a change let's get it in with v0.6.3

@rafaeldtinoco

Thanks for your effort. I collected the data again, and LTTng do have empty "dev_name", but tracee gives more records with empty "source". Here is the output (each has 47 records):

LTTng (3 empty "dev_name"):

[01:28:17.251119906] (+?.?????????) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 10879, vtid = 10879, ppid = 1, vppid = 1, procname = "dockerd", pid_ns = 4026531836, net_ns = 4026532000 }, { dev_name = "overlay", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54-init/merged", type = "overlay", flags = 0, data = 824641651104 }
[01:28:17.400157964] (+0.141715910) ubuntu syscall_entry_mount: { cpu_id = 0 }, { tid = 10879, vtid = 10879, ppid = 1, vppid = 1, procname = "dockerd", pid_ns = 4026531836, net_ns = 4026532000 }, { dev_name = "overlay", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged", type = "overlay", flags = 0, data = 824641741248 }
[01:28:17.545062279] (+0.143315483) ubuntu syscall_entry_mount: { cpu_id = 0 }, { tid = 1214, vtid = 1214, ppid = 1, vppid = 1, procname = "dockerd", pid_ns = 4026531836, net_ns = 4026532000 }, { dev_name = "overlay", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged", type = "overlay", flags = 0, data = 824642077120 }
[01:28:19.369595510] (+1.816473007) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32304, vtid = 32304, ppid = 32298, vppid = 32298, procname = "exe", pid_ns = 4026531836, net_ns = 4026532000 }, { dev_name = "/proc/self/exe", dir_name = "/var/run/docker/runtime-runc/moby/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339/runc.moP0HR", type = "", flags = 4096, data = 94784906124065 }
[01:28:19.370154657] (+0.000024520) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32304, vtid = 32304, ppid = 32298, vppid = 32298, procname = "exe", pid_ns = 4026531836, net_ns = 4026532000 }, { dev_name = "", dir_name = "/var/run/docker/runtime-runc/moby/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339/runc.moP0HR", type = "", flags = 4129, data = 94784906124065 }
[01:28:19.448175577] (+0.078007300) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "", dir_name = "/", type = "", flags = 540672, data = 0 }
[01:28:19.448623706] (+0.000422516) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged", type = "bind", flags = 20480, data = 0 }
[01:28:19.449528917] (+0.000736578) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "proc", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/proc", type = "proc", flags = 14, data = 0 }
[01:28:19.474798257] (+0.025013814) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "tmpfs", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/dev", type = "tmpfs", flags = 16777218, data = 824635519424 }
[01:28:19.475272976] (+0.000291789) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "devpts", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/dev/pts", type = "devpts", flags = 10, data = 824634336864 }
[01:28:19.475396288] (+0.000078207) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "sysfs", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys", type = "sysfs", flags = 14, data = 0 }
[01:28:19.476069245] (+0.000634537) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "tmpfs", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup", type = "tmpfs", flags = 14, data = 824635554112 }
[01:28:19.476250063] (+0.000114318) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/systemd/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/systemd", type = "bind", flags = 20494, data = 0 }
[01:28:19.476295315] (+0.000028298) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/systemd/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/systemd", type = "bind", flags = 20526, data = 0 }
[01:28:19.476398303] (+0.000087945) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/blkio/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/blkio", type = "bind", flags = 20494, data = 0 }
[01:28:19.476479948] (+0.000018370) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/blkio/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/blkio", type = "bind", flags = 20526, data = 0 }
[01:28:19.476608179] (+0.000116634) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/freezer/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/freezer", type = "bind", flags = 20494, data = 0 }
[01:28:19.476646289] (+0.000017805) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/freezer/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/freezer", type = "bind", flags = 20526, data = 0 }
[01:28:19.476811958] (+0.000141402) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/hugetlb/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/hugetlb", type = "bind", flags = 20494, data = 0 }
[01:28:19.476847010] (+0.000019604) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/hugetlb/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/hugetlb", type = "bind", flags = 20526, data = 0 }
[01:28:19.477033873] (+0.000161483) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/pids/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/pids", type = "bind", flags = 20494, data = 0 }
[01:28:19.477094116] (+0.000041501) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/pids/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/pids", type = "bind", flags = 20526, data = 0 }
[01:28:19.477211088] (+0.000098194) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/net_cls,net_prio/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/net_cls,net_prio", type = "bind", flags = 20494, data = 0 }
[01:28:19.477256031] (+0.000025833) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/net_cls,net_prio/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/net_cls,net_prio", type = "bind", flags = 20526, data = 0 }
[01:28:19.477412172] (+0.000143777) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/perf_event/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/perf_event", type = "bind", flags = 20494, data = 0 }
[01:28:19.477493806] (+0.000019579) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/perf_event/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/perf_event", type = "bind", flags = 20526, data = 0 }
[01:28:19.477649875] (+0.000145440) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/rdma", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/rdma", type = "bind", flags = 20494, data = 0 }
[01:28:19.477764485] (+0.000081467) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/rdma", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/rdma", type = "bind", flags = 20526, data = 0 }
[01:28:19.477946887] (+0.000160980) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/cpu,cpuacct/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/cpu,cpuacct", type = "bind", flags = 20494, data = 0 }
[01:28:19.477991337] (+0.000017513) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/cpu,cpuacct/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/cpu,cpuacct", type = "bind", flags = 20526, data = 0 }
[01:28:19.478161593] (+0.000156992) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/cpuset/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/cpuset", type = "bind", flags = 20494, data = 0 }
[01:28:19.478236719] (+0.000048253) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/cpuset/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/cpuset", type = "bind", flags = 20526, data = 0 }
[01:28:19.478378226] (+0.000124558) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/memory/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/memory", type = "bind", flags = 20494, data = 0 }
[01:28:19.478412855] (+0.000014916) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/memory/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/memory", type = "bind", flags = 20526, data = 0 }
[01:28:19.478573515] (+0.000150649) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/devices/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/devices", type = "bind", flags = 20494, data = 0 }
[01:28:19.484152868] (+0.005062836) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/devices/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/devices", type = "bind", flags = 20526, data = 0 }
[01:28:19.484434664] (+0.000243553) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "mqueue", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/dev/mqueue", type = "mqueue", flags = 14, data = 0 }
[01:28:19.484609643] (+0.000122090) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "shm", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/dev/shm", type = "tmpfs", flags = 14, data = 824635845824 }
[01:28:19.485568722] (+0.000898666) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/var/lib/docker/containers/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339/resolv.conf", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/resolv.conf", type = "bind", flags = 20480, data = 0 }
[01:28:19.485622592] (+0.000023030) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/memory/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/resolv.conf", type = "bind", flags = 278528, data = 0 }
[01:28:19.485750303] (+0.000117735) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/var/lib/docker/containers/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339/hostname", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/hostname", type = "bind", flags = 20480, data = 0 }
[01:28:19.485906786] (+0.000058114) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/cpuset/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/hostname", type = "bind", flags = 278528, data = 0 }
[01:28:19.491846205] (+0.000980307) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/var/lib/docker/containers/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339/hosts", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/hosts", type = "bind", flags = 20480, data = 0 }
[01:28:19.491896237] (+0.000020185) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/cpu,cpuacct/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/hosts", type = "bind", flags = 278528, data = 0 }
[01:28:20.555325212] (+1.063422513) ubuntu syscall_entry_mount: { cpu_id = 0 }, { tid = 1214, vtid = 1214, ppid = 1, vppid = 1, procname = "dockerd", pid_ns = 4026531836, net_ns = 4026532000 }, { dev_name = "/proc/32309/ns/net", dir_name = "/var/run/docker/netns/50a2711704ba", type = "bind", flags = 4096, data = 0 }
[01:28:30.883904433] (+10.324924630) ubuntu syscall_entry_mount: { cpu_id = 2 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "", dir_name = ".", type = "", flags = 540672, data = 0 }
[01:28:30.897811020] (+0.013886085) ubuntu syscall_entry_mount: { cpu_id = 2 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/dev/pts/0", dir_name = "/dev/console", type = "bind", flags = 4096, data = 0 }

Tracee (6 empty "source"):

{"timestamp":1633854497251128805,"processId":1080,"threadId":10879,"parentProcessId":1,"hostProcessId":1080,"hostThreadId":10879,"hostParentProcessId":1,"userId":0,"mountNamespace":2286848,"pidNamespace":4026531836,"processName":"dockerd","hostName":"ubuntu","containerId":"","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"overlay"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54-init/merged"},{"name":"filesystemtype","type":"const char*","value":"overlay"},{"name":"mountflags","type":"unsigned long","value":0},{"name":"data","type":"const void*","value":824641651104}]}
{"timestamp":1633854497400165360,"processId":1080,"threadId":10879,"parentProcessId":1,"hostProcessId":1080,"hostThreadId":10879,"hostParentProcessId":1,"userId":0,"mountNamespace":2286848,"pidNamespace":4026531836,"processName":"dockerd","hostName":"ubuntu","containerId":"","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"overlay"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged"},{"name":"filesystemtype","type":"const char*","value":"overlay"},{"name":"mountflags","type":"unsigned long","value":0},{"name":"data","type":"const void*","value":824641741248}]}
{"timestamp":1633854497545067915,"processId":1080,"threadId":1214,"parentProcessId":1,"hostProcessId":1080,"hostThreadId":1214,"hostParentProcessId":1,"userId":0,"mountNamespace":2286848,"pidNamespace":4026531836,"processName":"dockerd","hostName":"ubuntu","containerId":"","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"overlay"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged"},{"name":"filesystemtype","type":"const char*","value":"overlay"},{"name":"mountflags","type":"unsigned long","value":0},{"name":"data","type":"const void*","value":824642077120}]}
{"timestamp":1633854499369601449,"processId":32304,"threadId":32304,"parentProcessId":32300,"hostProcessId":32304,"hostThreadId":32304,"hostParentProcessId":32300,"userId":0,"mountNamespace":2286848,"pidNamespace":4026531836,"processName":"exe","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":4,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/proc/self/exe"},{"name":"target","type":"const char*","value":"/var/run/docker/runtime-runc/moby/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339/runc.moP0HR"},{"name":"mountflags","type":"unsigned long","value":4096},{"name":"data","type":"const void*","value":94784906124065}]}
{"timestamp":1633854499370159827,"processId":32304,"threadId":32304,"parentProcessId":32300,"hostProcessId":32304,"hostThreadId":32304,"hostParentProcessId":32300,"userId":0,"mountNamespace":2286848,"pidNamespace":4026531836,"processName":"exe","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":3,"returnValue":0,"stackAddresses":null,"args":[{"name":"target","type":"const char*","value":"/var/run/docker/runtime-runc/moby/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339/runc.moP0HR"},{"name":"mountflags","type":"unsigned long","value":4129},{"name":"data","type":"const void*","value":94784906124065}]}
{"timestamp":1633854499448183274,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":3,"returnValue":0,"stackAddresses":null,"args":[{"name":"target","type":"const char*","value":"/"},{"name":"mountflags","type":"unsigned long","value":540672},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499448633807,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20480},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499449535863,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"proc"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/proc"},{"name":"filesystemtype","type":"const char*","value":"proc"},{"name":"mountflags","type":"unsigned long","value":14},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499474804348,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"tmpfs"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/dev"},{"name":"filesystemtype","type":"const char*","value":"tmpfs"},{"name":"mountflags","type":"unsigned long","value":16777218},{"name":"data","type":"const void*","value":824635519424}]}
{"timestamp":1633854499475278067,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"devpts"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/dev/pts"},{"name":"filesystemtype","type":"const char*","value":"devpts"},{"name":"mountflags","type":"unsigned long","value":10},{"name":"data","type":"const void*","value":824634336864}]}
{"timestamp":1633854499475401104,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"sysfs"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys"},{"name":"filesystemtype","type":"const char*","value":"sysfs"},{"name":"mountflags","type":"unsigned long","value":14},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499476074650,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"tmpfs"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup"},{"name":"filesystemtype","type":"const char*","value":"tmpfs"},{"name":"mountflags","type":"unsigned long","value":14},{"name":"data","type":"const void*","value":824635554112}]}
{"timestamp":1633854499476256479,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/systemd/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/systemd"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20494},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499476305623,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/systemd/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/systemd"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20526},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499476404488,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/blkio/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/blkio"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20494},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499476486672,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/blkio/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/blkio"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20526},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499476614933,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/freezer/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/freezer"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20494},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499476653273,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/freezer/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/freezer"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20526},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499476818421,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/hugetlb/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/hugetlb"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20494},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499476868485,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/hugetlb/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/hugetlb"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20526},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499477040728,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/pids/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/pids"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20494},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499477104512,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/pids/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/pids"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20526},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499477217677,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/net_cls,net_prio/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/net_cls,net_prio"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20494},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499477264167,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/net_cls,net_prio/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/net_cls,net_prio"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20526},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499477457337,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/perf_event/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/perf_event"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20494},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499477501111,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/perf_event/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/perf_event"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20526},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499477656561,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/rdma"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/rdma"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20494},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499477774050,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/rdma"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/rdma"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20526},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499477954462,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/cpu,cpuacct/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/cpu,cpuacct"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20494},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499478000293,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/cpu,cpuacct/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/cpu,cpuacct"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20526},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499478169460,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/cpuset/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/cpuset"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20494},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499478245245,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/cpuset/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/cpuset"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20526},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499478385890,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/memory/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/memory"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20494},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499478419912,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/memory/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/memory"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20526},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499478581217,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/devices/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/devices"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20494},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499484161702,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/sys/fs/cgroup/devices/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/sys/fs/cgroup/devices"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20526},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499484441461,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"mqueue"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/dev/mqueue"},{"name":"filesystemtype","type":"const char*","value":"mqueue"},{"name":"mountflags","type":"unsigned long","value":14},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499484615482,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"shm"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/dev/shm"},{"name":"filesystemtype","type":"const char*","value":"tmpfs"},{"name":"mountflags","type":"unsigned long","value":14},{"name":"data","type":"const void*","value":824635845824}]}
{"timestamp":1633854499485576375,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/var/lib/docker/containers/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339/resolv.conf"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/resolv.conf"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20480},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499485628457,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":3,"returnValue":0,"stackAddresses":null,"args":[{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/resolv.conf"},{"name":"mountflags","type":"unsigned long","value":278528},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499485758259,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/var/lib/docker/containers/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339/hostname"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/hostname"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20480},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499485912735,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":3,"returnValue":0,"stackAddresses":null,"args":[{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/hostname"},{"name":"mountflags","type":"unsigned long","value":278528},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499491854494,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/var/lib/docker/containers/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339/hosts"},{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/hosts"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":20480},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499491901318,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":3,"returnValue":0,"stackAddresses":null,"args":[{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/hosts"},{"name":"mountflags","type":"unsigned long","value":278528},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854500555391105,"processId":1080,"threadId":1214,"parentProcessId":1,"hostProcessId":1080,"hostThreadId":1214,"hostParentProcessId":1,"userId":0,"mountNamespace":2286848,"pidNamespace":4026531836,"processName":"dockerd","hostName":"ubuntu","containerId":"","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/proc/32309/ns/net"},{"name":"target","type":"const char*","value":"/var/run/docker/netns/50a2711704ba"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":4096},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854510883910304,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":3,"returnValue":0,"stackAddresses":null,"args":[{"name":"target","type":"const char*","value":"."},{"name":"mountflags","type":"unsigned long","value":540672},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854510897815928,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":5,"returnValue":0,"stackAddresses":null,"args":[{"name":"source","type":"const char*","value":"/dev/pts/0"},{"name":"target","type":"const char*","value":"/dev/console"},{"name":"filesystemtype","type":"const char*","value":"bind"},{"name":"mountflags","type":"unsigned long","value":4096},{"name":"data","type":"const void*","value":0}]}

I'm not sure whether it's bug or not.

The command I ran:

sudo docker run -itd --rm --privileged --name test ubuntu bash > /dev/null 2>&1 &

lltng (1st, 2nd and last have empty dev_name)

[01:28:19.370154657] (+0.000024520) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32304, vtid = 32304, ppid = 32298, vppid = 32298, procname = "exe", pid_ns = 4026531836, net_ns = 4026532000 }, { dev_name = "", dir_name = "/var/run/docker/runtime-runc/moby/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339/runc.moP0HR", type = "", flags = 4129, data = 94784906124065 }
[01:28:19.448175577] (+0.078007300) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "", dir_name = "/", type = "", flags = 540672, data = 0 }
[01:28:19.485622592] (+0.000023030) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/memory/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/resolv.conf", type = "bind", flags = 278528, data = 0 }
[01:28:19.485906786] (+0.000058114) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/cpuset/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/hostname", type = "bind", flags = 278528, data = 0 }
[01:28:19.491896237] (+0.000020185) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/cpu,cpuacct/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/hosts", type = "bind", flags = 278528, data = 0 }
[01:28:30.883904433] (10.324924630) ubuntu syscall_entry_mount: { cpu_id = 2 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "", dir_name = ".", type = "", flags = 540672, data = 0 }

tracee (missing source because its empty, security_sb_mount would have showed empty dev_name)

{"timestamp":1633854499370159827,"processId":32304,"threadId":32304,"parentProcessId":32300,"hostProcessId":32304,"hostThreadId":32304,"hostParentProcessId":32300,"userId":0,"mountNamespace":2286848,"pidNamespace":4026531836,"processName":"exe","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":3,"returnValue":0,"stackAddresses":null,"args":[{"name":"target","type":"const char*","value":"/var/run/docker/runtime-runc/moby/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339/runc.moP0HR"},{"name":"mountflags","type":"unsigned long","value":4129},{"name":"data","type":"const void*","value":94784906124065}]}
{"timestamp":1633854499448183274,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":3,"returnValue":0,"stackAddresses":null,"args":[{"name":"target","type":"const char*","value":"/"},{"name":"mountflags","type":"unsigned long","value":540672},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499485628457,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":3,"returnValue":0,"stackAddresses":null,"args":[{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/resolv.conf"},{"name":"mountflags","type":"unsigned long","value":278528},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499485912735,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":3,"returnValue":0,"stackAddresses":null,"args":[{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/hostname"},{"name":"mountflags","type":"unsigned long","value":278528},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854499491901318,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":3,"returnValue":0,"stackAddresses":null,"args":[{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/hosts"},{"name":"mountflags","type":"unsigned long","value":278528},{"name":"data","type":"const void*","value":0}]}
{"timestamp":1633854510883910304,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":3,"returnValue":0,"stackAddresses":null,"args":[{"name":"target","type":"const char*","value":"."},{"name":"mountflags","type":"unsigned long","value":540672},{"name":"data","type":"const void*","value":0}]}

Picking 1: lttng 3rd (dev_name = "/sys/fs/cgroup/memory/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339" missing dev_name, target seems fine)

[01:28:19.485622592] (+0.000023030) ubuntu syscall_entry_mount: { cpu_id = 3 }, { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 }, { dev_name = "/sys/fs/cgroup/memory/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339", dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/resolv.conf", type = "bind", flags = 278528, data = 0 }

Picking 1: tracee 3rd (missing dev_name, target seems fine)

{"timestamp":1633854499485628457,"processId":1,"threadId":1,"parentProcessId":32300,"hostProcessId":32309,"hostThreadId":32309,"hostParentProcessId":32300,"userId":0,"mountNamespace":187998208,"pidNamespace":4026532649,"processName":"runc:[2:INIT]","hostName":"ubuntu","containerId":"2a09e07bdac0","eventId":"165","eventName":"mount","argsNum":3,"returnValue":0,"stackAddresses":null,"args":[{"name":"target","type":"const char*","value":"/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/resolv.conf"},{"name":"mountflags","type":"unsigned long","value":278528},{"name":"data","type":"const void*","value":0}]}

Problematic mount operation:

procname = runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651
dev_name = /sys/fs/cgroup/memory/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339 <- this is actually a cgroup v1 containing the docker container INIT process
dir_name = /var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/resolv.conf
type = "bind",
flags = 278528,
data = 0

TODO:

I need to check why lltng is showing the docker container PID=1 process cgroup fs directory as dev_name when a bind is done for a particular file.

docker initialization with bind mount for a single file:

$ docker run --rm -v /etc/resolv.conf:/etc/resolv.conf.host --privileged --entrypoint /bin/sh -it ubuntu:hirsute

tracee (49 events)

$ sudo ./dist/tracee-ebpf --trace event=security_sb_mount

TIME             UID    COMM             PID     TID     RET              EVENT                ARGS
14:05:06:630159  0      dockerd          2487798 2487805 0                security_sb_mount    dev_name: overlay, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb-init/merged, type: overlay, flags: 0
14:05:06:654107  0      dockerd          2487798 2487805 0                security_sb_mount    dev_name: overlay, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged, type: overlay, flags: 0
14:05:06:671076  0      dockerd          2487798 2487805 0                security_sb_mount    dev_name: overlay, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged, type: overlay, flags: 0
14:05:06:833628  0      exe              3173218 3173218 0                security_sb_mount    dev_name: /proc/self/exe, path: /run/docker/runtime-runc/moby/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e/runc.TjFvky, type: , flags: 4096
    14:05:06:833881  0      exe              3173218 3173218 0                security_sb_mount    dev_name: , path: /run/docker/runtime-runc/moby/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e/runc.TjFvky, type: , flags: 4129
    14:05:06:887454  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: , path: /, type: , flags: 540672
14:05:06:887822  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged, type: bind, flags: 20480
14:05:06:888008  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: proc, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/proc, type: proc, flags: 14
14:05:06:888287  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: tmpfs, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/dev, type: tmpfs, flags: 16777218
14:05:06:888627  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: devpts, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/dev/pts, type: devpts, flags: 10
14:05:06:888865  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: sysfs, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys, type: sysfs, flags: 14
14:05:06:889648  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: tmpfs, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup, type: tmpfs, flags: 14
14:05:06:890012  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/systemd/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/systemd, type: bind, flags: 20494
14:05:06:890188  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/systemd/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/systemd, type: bind, flags: 20526
14:05:06:890420  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/devices/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/devices, type: bind, flags: 20494
14:05:06:890568  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/devices/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/devices, type: bind, flags: 20526
14:05:06:890778  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/pids/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/pids, type: bind, flags: 20494
14:05:06:890926  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/pids/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/pids, type: bind, flags: 20526
14:05:06:891135  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/memory/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/memory, type: bind, flags: 20494
14:05:06:891300  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/memory/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/memory, type: bind, flags: 20526
14:05:06:891501  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/cpu,cpuacct/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/cpu,cpuacct, type: bind, flags: 20494
14:05:06:891662  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/cpu,cpuacct/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/cpu,cpuacct, type: bind, flags: 20526
14:05:06:891880  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/hugetlb/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/hugetlb, type: bind, flags: 20494
14:05:06:892058  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/hugetlb/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/hugetlb, type: bind, flags: 20526
14:05:06:892243  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/rdma, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/rdma, type: bind, flags: 20494
14:05:06:892391  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/rdma, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/rdma, type: bind, flags: 20526
14:05:06:892603  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/net_cls,net_prio/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/net_cls,net_prio, type: bind, flags: 20494
14:05:06:892758  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/net_cls,net_prio/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/net_cls,net_prio, type: bind, flags: 20526
14:05:06:892958  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/freezer/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/freezer, type: bind, flags: 20494
14:05:06:893117  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/freezer/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/freezer, type: bind, flags: 20526
14:05:06:893310  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/perf_event/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/perf_event, type: bind, flags: 20494
14:05:06:893503  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/perf_event/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/perf_event, type: bind, flags: 20526
14:05:06:893716  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/blkio/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/blkio, type: bind, flags: 20494
14:05:06:893873  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/blkio/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/blkio, type: bind, flags: 20526
14:05:06:894059  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/cpuset/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/cpuset, type: bind, flags: 20494
14:05:06:894210  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /sys/fs/cgroup/cpuset/docker/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/sys/fs/cgroup/cpuset, type: bind, flags: 20526
14:05:06:894392  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: mqueue, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/dev/mqueue, type: mqueue, flags: 14
14:05:06:894579  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: shm, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/dev/shm, type: tmpfs, flags: 14
14:05:06:895116  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /etc/resolv.conf, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/etc/resolv.conf.host, type: bind, flags: 20480
    14:05:06:895197  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: , path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/etc/resolv.conf.host, type: , flags: 278528
14:05:06:895344  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /var/lib/docker/containers/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e/resolv.conf, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/etc/resolv.conf, type: bind, flags: 20480
    14:05:06:895426  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: , path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/etc/resolv.conf, type: , flags: 278528
14:05:06:895569  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /var/lib/docker/containers/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e/hostname, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/etc/hostname, type: bind, flags: 20480
    14:05:06:895648  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: , path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/etc/hostname, type: , flags: 278528
14:05:06:895790  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /var/lib/docker/containers/a9029afcd059defe354a514ae287c5e16996ffdeb8688c6c3c262372ef3a3b8e/hosts, path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/etc/hosts, type: bind, flags: 20480
    14:05:06:895864  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: , path: /var/lib/docker/overlay2/95b6df1de55d7c0db6519afb87866b135b50e2fe23a771e1c27cbc3f8966a3fb/merged/etc/hosts, type: , flags: 278528
14:05:06:967330  0      dockerd          2487798 2487957 0                security_sb_mount    dev_name: /proc/3173221/ns/net, path: /run/docker/netns/d8a76344f311, type: bind, flags: 4096
    14:05:07:161442  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: , path: /, type: , flags: 540672
14:05:07:162210  0      runc:[2:INIT]    1       1       0                security_sb_mount    dev_name: /dev/pts/0, path: /dev/console, type: bind, flags: 4096

lttng (49 events)

[13:56:25.599037987] (+?.?????????) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "overlay", dir_name = "/var/lib/docker/overlay2/4ba8901d646aa96b90a8649e8e3fd7b0bd25d1c9c570d3e46c52fffc9bbd19c9-init/merged", type = "overlay", flags = 0, data = 824645812544 }
[13:56:25.626642332] (+0.026977690) fujitsu syscall_entry_mount: { cpu_id = 4 }, { dev_name = "overlay", dir_name = "/var/lib/docker/overlay2/4ba8901d646aa96b90a8649e8e3fd7b0bd25d1c9c570d3e46c52fffc9bbd19c9/merged", type = "overlay", flags = 0, data = 824637596704 }
[13:56:25.649884533] (+0.022899846) fujitsu syscall_entry_mount: { cpu_id = 7 }, { dev_name = "overlay", dir_name = "/var/lib/docker/overlay2/4ba8901d646aa96b90a8649e8e3fd7b0bd25d1c9c570d3e46c52fffc9bbd19c9/merged", type = "overlay", flags = 0, data = 824647312064 }
[13:56:25.809621430] (+0.158962055) fujitsu syscall_entry_mount: { cpu_id = 0 }, { dev_name = "/proc/self/exe", dir_name = "/var/run/docker/runtime-runc/moby/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad/runc.9YJyK8", type = "", flags = 4096, data = 94837636074005 }
    [13:56:25.809793479] (+0.000002618) fujitsu syscall_entry_mount: { cpu_id = 0 }, { dev_name = "", dir_name = "/var/run/docker/runtime-runc/moby/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad/runc.9YJyK8", type = "", flags = 4129, data = 94837636074005 }
    [13:56:25.849100876] (+0.039298805) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "", dir_name = "/", type = "", flags = 540672, data = 0 }
[13:56:25.849454989] (+0.000333273) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/var/lib/docker/overlay2/4ba8901d646aa96b90a8649e8e3fd7b0bd25d1c9c570d3e46c52fffc9bbd19c9/merged", dir_name = "/var/lib/docker/overlay2/4ba8901d646aa96b90a8649e8e3fd7b0bd25d1c9c570d3e46c52fffc9bbd19c9/merged", type = "bind", flags = 20480, data = 0 }
[13:56:25.849562237] (+0.000082761) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "proc", dir_name = "/proc/self/fd/7", type = "proc", flags = 14, data = 0 }
[13:56:25.849797812] (+0.000091760) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "tmpfs", dir_name = "/proc/self/fd/7", type = "tmpfs", flags = 16777218, data = 824634428480 }
[13:56:25.850072011] (+0.000138888) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "devpts", dir_name = "/proc/self/fd/7", type = "devpts", flags = 10, data = 824634918352 }
[13:56:25.850290859] (+0.000081845) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "sysfs", dir_name = "/proc/self/fd/7", type = "sysfs", flags = 14, data = 0 }
[13:56:25.850942823] (+0.000539774) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "tmpfs", dir_name = "/proc/self/fd/7", type = "tmpfs", flags = 14, data = 824634455648 }
[13:56:25.851251997] (+0.000178807) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/systemd/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20494, data = 0 }
[13:56:25.851365930] (+0.000095121) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/systemd/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20526, data = 0 }
[13:56:25.851475120] (+0.000102900) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/devices/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20494, data = 0 }
[13:56:25.851564550] (+0.000072169) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/devices/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20526, data = 0 }
[13:56:25.851701816] (+0.000131603) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/pids/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20494, data = 0 }
[13:56:25.851788456] (+0.000071979) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/pids/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20526, data = 0 }
[13:56:25.851898789] (+0.000104311) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/memory/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20494, data = 0 }
[13:56:25.852061430] (+0.000143953) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/memory/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20526, data = 0 }
[13:56:25.852173737] (+0.000106814) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/cpu,cpuacct/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20494, data = 0 }
[13:56:25.852261163] (+0.000071216) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/cpu,cpuacct/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20526, data = 0 }
[13:56:25.852367231] (+0.000100928) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/hugetlb/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20494, data = 0 }
[13:56:25.852450562] (+0.000067894) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/hugetlb/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20526, data = 0 }
[13:56:25.852550296] (+0.000094735) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/rdma", dir_name = "/proc/self/fd/7", type = "bind", flags = 20494, data = 0 }
[13:56:25.852630008] (+0.000067115) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/rdma", dir_name = "/proc/self/fd/7", type = "bind", flags = 20526, data = 0 }
[13:56:25.852744283] (+0.000109870) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/net_cls,net_prio/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20494, data = 0 }
[13:56:25.852832273] (+0.000060682) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/net_cls,net_prio/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20526, data = 0 }
[13:56:25.852931612] (+0.000094174) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/freezer/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20494, data = 0 }
[13:56:25.853013740] (+0.000067872) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/freezer/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20526, data = 0 }
[13:56:25.853114455] (+0.000095418) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/perf_event/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20494, data = 0 }
[13:56:25.853191566] (+0.000063828) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/perf_event/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20526, data = 0 }
[13:56:25.853286886] (+0.000090177) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/blkio/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20494, data = 0 }
[13:56:25.853360559] (+0.000060187) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/blkio/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20526, data = 0 }
[13:56:25.853451456] (+0.000085879) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/cpuset/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20494, data = 0 }
[13:56:25.853527136] (+0.000058662) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/sys/fs/cgroup/cpuset/docker/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad", dir_name = "/proc/self/fd/7", type = "bind", flags = 20526, data = 0 }
[13:56:25.853617151] (+0.000085119) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "mqueue", dir_name = "/proc/self/fd/7", type = "mqueue", flags = 14, data = 0 }
[13:56:25.853715284] (+0.000082617) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "shm", dir_name = "/proc/self/fd/7", type = "tmpfs", flags = 14, data = 824634746944 }
[13:56:25.854085838] (+0.000249391) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/etc/resolv.conf", dir_name = "/proc/self/fd/7", type = "bind", flags = 20480, data = 0 }
    [13:56:25.854121880] (+0.000024612) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "", dir_name = "/proc/self/fd/7", type = "", flags = 278528, data = 0 }
[13:56:25.854197886] (+0.000072211) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/var/lib/docker/containers/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad/resolv.conf", dir_name = "/proc/self/fd/7", type = "bind", flags = 20480, data = 0 }
    [13:56:25.854244839] (+0.000032087) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "", dir_name = "/proc/self/fd/7", type = "", flags = 278528, data = 0 }
[13:56:25.854308694] (+0.000060156) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/var/lib/docker/containers/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad/hostname", dir_name = "/proc/self/fd/7", type = "bind", flags = 20480, data = 0 }
    [13:56:25.854343651] (+0.000023279) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "", dir_name = "/proc/self/fd/7", type = "", flags = 278528, data = 0 }
[13:56:25.854405345] (+0.000058199) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/var/lib/docker/containers/3bef598402cfd5dd60d2e8ae86fea56813459bb8798907a6d6acf366681c6cad/hosts", dir_name = "/proc/self/fd/7", type = "bind", flags = 20480, data = 0 }
    [13:56:25.854440701] (+0.000024348) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "", dir_name = "/proc/self/fd/7", type = "", flags = 278528, data = 0 }
[13:56:25.913806902] (+0.059362549) fujitsu syscall_entry_mount: { cpu_id = 1 }, { dev_name = "/proc/3093910/ns/net", dir_name = "/var/run/docker/netns/79f735f0e204", type = "bind", flags = 4096, data = 0 }
    [13:56:26.193065900] (+0.279073152) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "", dir_name = ".", type = "", flags = 540672, data = 0 }
[13:56:26.193683502] (+0.000587007) fujitsu syscall_entry_mount: { cpu_id = 2 }, { dev_name = "/dev/pts/0", dir_name = "/dev/console", type = "bind", flags = 4096, data = 0 }

For my reproducer I can count the exact same amount of missing "dev_name" mount calls.

continuing on your buggy example:

{ cpu_id = 3 },
    { tid = 32309, vtid = 1, ppid = 32298, vppid = 0, procname = "runc:[2:INIT]", pid_ns = 4026532649, net_ns = 4026532651 },
    { dev_name = "/sys/fs/cgroup/memory/docker/2a09e07bdac0f9ff162eee310ddfe61b6f0ae6a1a72e5f7bec97f6c9f96a3339",
      dir_name = "/var/lib/docker/overlay2/cb25d821fd2087f80d5d708ee88e5b8fc8794e21ca2479bffb4e5c018ec71b54/merged/etc/resolv.conf",
      type = "bind",
      flags = 278528,
      data = 0
    }

This looks like a bug on lttng side, likely a race condition when showing dev_name versus dir_name.
All the cgroupfs bind mounts target a file descriptor.
In your buggy example, the cgroupfs dev_name it is targetting a file that is actually a file-based bind mount.
A file based bind mount has a file as "dev_name" as another file as "target" or "path".
All subtree operations on shared mounts show no "dev_name" (either empty or "none").

example on how the correct operation works:

docker is initially bind mounting the file /etc/resolv.conf to a directory result of an overlay mount.
docker does a mount --make-rprivate to .../merged/etc/resolv.conf so it cannot forward or receive propagations.
it propates the bind mount to other containers

similar commands:

$ sudo mount --make-rprivate /merged
$ sudo touch /etc/e
$ sudo touch /merged/hosts
$ touch /merged/hosts
$ sudo mount -o bind /merged/hosts /etc/testing
$ sudo mount --make-rprivate /etc/testing
$ sudo mount -o bind /etc/hosts /merged/hosts.host
$ sudo mount --make-rprivate /merged/hosts.host

result:

$ sudo ./dist/tracee-ebpf --trace event=security_sb_mount
TIME             UID    COMM             PID     TID     RET              EVENT                ARGS
14:19:36:920329  0      mount            3302643 3302643 0                security_sb_mount    dev_name: overlay, path: /merged, type: overlay, flags: 0
14:19:49:768942  0      mount            3305634 3305634 0                security_sb_mount    dev_name: none, path: /merged, flags: 278528
14:20:21:260434  0      mount            3308808 3308808 0                security_sb_mount    dev_name: none, path: /merged/hosts, flags: 278528
14:20:36:225821  0      mount            3311878 3311878 0                security_sb_mount    dev_name: /merged/hosts, path: /etc/testing, type: none, flags: 4096
14:20:48:260745  0      mount            3312037 3312037 0                security_sb_mount    dev_name: none, path: /etc/testing, flags: 278528
14:23:00:100334  0      mount            3334107 3334107 0                security_sb_mount    dev_name: /etc/hosts, path: /merged/hosts.host, type: none, flags: 4096
14:23:15:934267  0      mount            3334231 3334231 0                security_sb_mount    dev_name: none, path: /merged/hosts.host, flags: 278528

as you can see, "none" here is added by the "util-linux" package, orelse it could be empty also (like docker does).

Conclusion:

IMO, the "dev_name" being showed when executing shared subtree operation, when dev_name is "none" or empty, is likely a leftover from a previous triggered probe within LTTNG.

I'm going to go ahead and close this based on the above conclusion.

aquasecurity / tracee