eliasgranderubio / dagda

a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities
Apache License 2.0
1.15k stars 160 forks source link

Stop sysdig/falco failed when restart dagda server. #51

Closed axiqia closed 5 years ago

axiqia commented 5 years ago

Short description

If Dagda server is started twice, it will fail like issue48.

Reproduction steps

  1. start dagda server python3 dagda.py start -p 5003 -d
  2. stop it with CTRL + C
  3. start another dagda server python3 dagda.py start -p 5000 -d

Expected results

I expected that the dagda server start successfully both.

Actual results

<2019-03-12 15:09:41,921> <DEBUG> <DagdaServer> <sysdig_falco_monitor> <pre_check:95> <737948e77328251a8c0555dcf9d6767ba0eea108c984e860aeab54e2c07bfc44>
<2019-03-12 15:09:41,921> <DEBUG> <DagdaServer> <docker_driver> <docker_stop:110> <7>
<2019-03-12 15:09:41,926> <ERROR> <DagdaServer> <dagda> <main:46> <500 Server Error: Internal Server Error ("Multiple IDs found with provided prefix: 737948e77328251a8c0555dcf9d6767ba0eea108c984e860aeab54e2c07bfc44")>
Traceback (most recent call last):  File "/home/sxue/project/dagda/dagdaenv/lib/python3.7/site-packages/docker/api/client.py", line 246, in _raise_for_status
    response.raise_for_status()
  File "/home/sxue/project/dagda/dagdaenv/lib/python3.7/site-packages/requests/models.py", line 940, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 500 Server Error: Internal Server Error for url: http+docker://localhost/v1.37/containers/7/stop

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "dagda/dagda.py", line 35, in main    r = execute_dagda_cmd(cmd=cmd, args=parsed_args)
  File "/home/sxue/project/dagda/dagda/cli/dagda_cli.py", line 43, in execute_dagda_cmd
    ds.run()  File "/home/sxue/project/dagda/dagda/api/dagda_server.py", line 101, in run
    self.sysdig_falco_monitor.pre_check()
  File "/home/sxue/project/dagda/dagda/analysis/runtime/sysdig_falco_monitor.py", line 98, in pre_check
    self.docker_driver.docker_stop(container_id)
  File "/home/sxue/project/dagda/dagda/driver/docker_driver.py", line 111, in docker_stop
    self.cli.stop(container=container_id)
  File "/home/sxue/project/dagda/dagdaenv/lib/python3.7/site-packages/docker/utils/decorators.py", line 19, in wrapped
    return f(self, resource_id, *args, **kwargs)
  File "/home/sxue/project/dagda/dagdaenv/lib/python3.7/site-packages/docker/api/container.py", line 1134, in stop
    self._raise_for_status(res)
  File "/home/sxue/project/dagda/dagdaenv/lib/python3.7/site-packages/docker/api/client.py", line 248, in _raise_for_status
    raise create_api_error_from_http_exception(e)
  File "/home/sxue/project/dagda/dagdaenv/lib/python3.7/site-packages/docker/errors.py", line 31, in create_api_error_from_http_exception
    raise cls(e, response=response, explanation=explanation)
docker.errors.APIError: 500 Server Error: Internal Server Error ("Multiple IDs found with provided prefix: 737948e77328251a8c0555dcf9d6767ba0eea108c984e860aeab54e2c07bfc44")

I printed the container_id to log, you can seen that the container_id is only the first number when stop container sysdig/falco. <2019-03-12 14:39:18,563> <DEBUG> <DagdaServer> <docker_driver> <docker_stop:110> <7> [3/1822]

axiqia commented 5 years ago

I have open a PR to fix this issue,https://github.com/eliasgranderubio/dagda/pull/52

eliasgranderubio commented 5 years ago

I have reviewed the PR #52 and I agree with you but that PR mixes issue fixing with documentation improving.

My commit includes your suggest and it replaces the 'equal' by 'append' and now all look like works fine. Please, review it and give me feedback if the error persists.

On the other hand, I have seen the SVG and it is not entirely true. Feel free to open me another issue for improving the documentation about the internal work flow and I will include the complete flow ;-)

axiqia commented 5 years ago

All look like works fine. And I will open a new issue about work flow