Add tables to query Podman containers

fleetdm / fleet

Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)

https://fleetdm.com

Other

3.16k stars 432 forks source link

Add tables to query Podman containers #23475

Open orlovds opened 3 weeks ago

orlovds commented 3 weeks ago

@noahtalerman: User requested this because they're using Podman instead of Docker and the want a way to write an osquery query to get information about their Podman containers.
- @noahtalerman: Eventually the user might be able to write a query against something like podman_volumes table (ala docker_volumes).

noahtalerman commented 3 weeks ago

Problem

Many servers use podman (https://podman.io/) instead of docker. The commands docker_container_labels, docker_container_envs, etc. do not work with podman.

What have you tried?

I tried calling docker_* commands, they don't work with podman.

Potential solutions

Extending docker* commands to podman or creating a set of podman* commands.

What is the expected workflow as a result of your proposal?

Getting data about containers running in podman

noahtalerman commented 3 weeks ago

Hey @orlovds, thanks for tracking this. I like the commitment to open source.

We're setting this request to the side for now. That said, please feel free to take a stab at opening a pull request that adds one or more of these tables to the osquery repo: https://github.com/osquery/osquery

orlovds commented 3 weeks ago

@noahtalerman Thanks for the support!

I wrote issue in osquery: https://github.com/osquery/osquery/issues/8464

sharon-fdm commented 2 weeks ago

@noahtalerman, what would be a proper labeling for this ticket?

noahtalerman commented 2 weeks ago

@sharon-fdm there are no labels on this b/c we decided to set it to the side for now.

If you think we should consider prioritizing it, please add the ~feature-fest label. This will add it to the feature fest board so that we remember to weigh it at the next feature fest.