weaveworks / tcptracer-bpf

eBPF program using kprobes to trace TCP events without run-time compilation dependencies
Apache License 2.0
410 stars 61 forks source link

offset guessing confused from inside Docker #71

Closed mranney-dd closed 4 years ago

mranney-dd commented 4 years ago

I'm trying to use tcptracer as a library on Ubuntu 20.04. I can run the test program and my program in the host OS, but when I try to run this in Docker the guessing fails. The bcc documentation says to build from source, so I have included those steps in the Dockerfile below.

# ./tracer
failed to init perf map for IPv4 events: error guessing offsets: invalid guessing state while guessing source address, got checking expected checked

Container is started with:

$ docker run -it --rm --privileged -v /sys/kernel/debug:/sys/kernel/debug 354b98390880

Dockerfile is:

FROM ubuntu:20.04

ENV DEBIAN_FRONTEND="noninteractive"

RUN apt-get update
RUN apt-get -y install net-tools libelf1:amd64 golang-1.14 ca-certificates bison build-essential \
 cmake flex git libedit-dev libllvm7 llvm-7-dev libclang-7-dev python zlib1g-dev libelf-dev

WORKDIR /build
RUN git clone https://github.com/iovisor/bcc.git
RUN mkdir bcc/build
WORKDIR /build/bcc/build
RUN cmake ..
RUN make
RUN make install

ENV PATH="${PATH}:/usr/lib/go-1.14/bin"

WORKDIR /src
COPY . .
RUN go mod download
RUN go build
mranney-dd commented 4 years ago

Fixed on slack, solution is:

docker run --pid=host -v /sys/kernel/debug:/sys/kernel/debug --privileged