Skip to content

feat(ROX-35830): make fact container aware - #1900

Draft
Molter73 wants to merge 1 commit into
mainfrom
mauro/feat/container-awareness
Draft

Molter73 wants to merge 1 commit into
mainfrom
mauro/feat/container-awareness

Conversation

@Molter73

Copy link
Copy Markdown
Member

Description

This implementation queries the docker socket for information about running containers in the system, then attaches this information to the event being generated from the kernel. A stream of events from the docker socket is used to keep the container data in sync. The attached information is then serialized in the stdout and OTEL output components, gRPC is not implemented since it requires changes to the share protobuf definitions.

The entire feature is behind the container feature flag, so it can be easily removed at compile time when not needed.

TODO:

  • Add tests.
  • Test on docker (currently only tested on podman with the podman-docker package).

Checklist

  • Patch has a change log entry OR does not need one.
  • Investigated and inspected CI test results
  • Updated documentation accordingly

Automated testing

  • Added unit tests
  • Added integration tests
  • Added regression tests

If any of these don't apply, please comment below.

Testing Performed

TODO(replace-me)
Use this space to explain how you tested your PR, or, if you didn't test it, why you did not do so. (Valid reasons include "CI is sufficient" or "No testable changes")
In addition to reviewing your code, reviewers must also review your testing instructions, and make sure they are sufficient.

For more details, ref the Confluence page about this section.

This implementation queries the docker socket for information about
running containers in the system, then attaches this information to the
event being generated from the kernel. A stream of events from the
docker socket is used to keep the container data in sync. The attached
information is then serialized in the stdout and OTEL output components,
gRPC is not implemented since it requires changes to the share protobuf
definitions.

The entire feature is behind the `container` feature flag, so it can be
easily removed at compile time when not needed.

TODO:
* Add tests.
@coderabbitai

coderabbitai Bot commented Sep 25, 2026

Copy link
Copy Markdown

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Comment @coderabbitai help to get the list of available commands.

@codecov-commenter

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 93.93939% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 34.01%. Comparing base (6eb1ea8) to head (7b75553).

Files with missing lines Patch % Lines
fact/src/event/process.rs 50.00% 2 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1900      +/-   ##
==========================================
+ Coverage   33.47%   34.01%   +0.54%     
==========================================
  Files          22       22              
  Lines        3621     3654      +33     
  Branches     3621     3654      +33     
==========================================
+ Hits         1212     1243      +31     
- Misses       2400     2402       +2     
  Partials        9        9              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants