[robbycochran]

Description

Enrich Fact file events with an optional process.container_image in JSON and OTEL output. One CRI v1 ContainerStatus call supplies image_id, falling back to image_ref when the ID is empty. Values are preserved as returned by the runtime; an image ID need not be a pullable reference. No second RPC or verbose runtime-specific parsing is needed.

Enable with the non-default runtime-metadata Cargo feature and an absolute FACT_CRI_SOCKET path visible to Fact. Debug logging is not required. Local standard/OTEL image builds enable the feature; Konflux release builds exclude it.

The isolated feature module owns its Unix connection, background worker, and bounded image cache. The output pipeline makes one enrichment call before broadcasting each event. Cache misses schedule work and leave the image field absent; later events use the cached image. Event delivery never waits for a runtime RPC. Requests have a one-second deadline, a 128-ID queue, and a 1,024-entry cache. Pending, successful, and failed entries expire after 30 seconds; later events can request refreshes.

Replay preserves recorded image metadata without querying the runtime. Existing abbreviated container IDs and Sensor protobuf output are unchanged. The full ID is retained privately only to address and validate the CRI lookup.

Follow-up PRs

1. Expose the full container ID and consolidate its internal representation.
2. Collect mounts from the same ContainerStatus response.
3. Collect labels from the same response.

This PR decodes only the response ID and image ID/reference. It does not collect container names, lifecycle state, timestamps, mounts, labels, or verbose info.

Checklist

• Patch has a change log entry OR does not need one: experimental feature is excluded from Konflux release builds.
• Investigated and inspected CI test results: preceding revision passed all four basic build/test jobs; RHCOS integration and Konflux Fedora CoreOS integration failed. Root causes remain unconfirmed. Updated revision CI is pending.
• Updated documentation accordingly

Automated testing

• Added unit tests
• Added integration tests: fake CRI service over a real Unix socket and HTTP/2 gRPC, through event enrichment and JSON/OTEL conversion
• Added regression tests: image ID preference/reference fallback, omission on cache miss, cache reuse/limits/expiry, RPC errors/timeouts, queue saturation, unchanged abbreviated container IDs, and replay preservation without lookups

Testing Performed

Passed locally in a Linux arm64 container:

• cargo test --lib: 116 tests
• cargo test --features runtime-metadata --lib: 124 tests
• cargo test --features otel --lib: 116 tests
• cargo test --features otel,runtime-metadata --lib: 124 tests
• cargo check --no-default-features
• cargo clippy --all-targets --all-features -- -D warnings
• cargo fmt --all --check and git diff --check

Live CRI-O/containerd node validation has not been performed. Tests exercise the gRPC transport using a fake runtime.

Summary by CodeRabbit

• New Features
  • Events can include container image metadata retrieved from a configured CRI socket for processes with runtime container IDs. Lookups run in the background, and unavailable or empty image details leave the event unchanged.
  • Local container image builds enable runtime metadata support by default; direct Cargo builds can enable it with the runtime-metadata feature.
• Documentation
  • Documented CRI socket configuration, image metadata behavior, lookup limits, and build options.
• Tests
  • Added CI coverage for builds with runtime metadata enabled.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T19:35:07.199226Z	6b16788	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: stackrox/fact/.coderabbit.yml
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 7d9f86a8-2e35-4256-9dd7-8b463581bdea

📥 Commits

Reviewing files that changed from the base of the PR and between 6b16788 and abb3690.

📒 Files selected for processing: 7

• .github/workflows/ci.yml
• docs/references.md
• fact/src/event/mod.rs
• fact/src/event/process.rs
• fact/src/features/runtime_metadata.rs
• fact/src/features/runtime_metadata/tests.rs
• fact/src/output/mod.rs

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

📝 Walkthrough

The runtime-metadata feature retains full container IDs and can query CRI ContainerStatus over a Unix socket. Events are enriched with available container image data before forwarding. The change also updates feature builds, CI tests, and configuration documentation.

Changes: CRI runtime image enrichment

Layer / File(s)	Summary
Process data and CRI lookup fact/Cargo.toml, fact/src/features/*, fact/src/lib.rs, fact/src/event/process.rs	Feature-gated process data retains the full container ID while existing serialized and signal IDs remain 12 characters. The enricher performs bounded CRI status lookups and selects image_id, falling back to image_ref. Tests cover lookup responses, errors, timeouts, queue behavior, and cache limits.
Event enrichment and output fact/src/event/mod.rs, fact/src/output/mod.rs, fact/src/event/process.rs, fact/src/features/runtime_metadata/tests.rs	Output initializes the enricher from the environment and enriches events before forwarding them. JSON and OpenTelemetry conversions include the image when present. Tests cover cached enrichment and replay behavior.
Feature builds and validation Makefile, Containerfile, .github/workflows/ci.yml, docs/references.md	Local image targets enable runtime-metadata, CI runs the feature-enabled test suite, and the reference documentation describes the socket setting and lookup behavior.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant Output as output::start
  participant Enricher
  participant Worker
  participant CRI as CRI runtime
  participant Subscribers as Output subscribers
  Output->>Enricher: Initialize from FACT_CRI_SOCKET
  Output->>Enricher: Request image for event container ID
  Enricher->>Worker: Queue container ID
  Worker->>CRI: Request ContainerStatus
  CRI-->>Worker: Return status
  Output->>Subscribers: Forward enriched event

Loading

Suggested reviewers: molter73

Merge Risk: ⚪ Minimal · up to abb36

Image metadata may be briefly absent after cache expiry as documented. No actionable issue remains before merge.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 40.63% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 32 functions across 7 files. (2 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly describes the main change: optional CRI image identity enrichment for file events.
Description check		The description explains the feature, configuration, behavior, limits, testing, documentation, checklist status, and known validation gaps. It satisfies the repository template.

Full details: Docstring Coverage

Explanation

Docstring coverage is 40.63% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 32 functions across 7 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 2

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 66.66667% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 33.54%. Comparing base (525cac1) to head (abb3690).

Files with missing lines	Patch %	Lines
fact/src/event/process.rs	66.66%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2112      +/-   ##
==========================================
+ Coverage   33.45%   33.54%   +0.09%     
==========================================
  Files          22       22              
  Lines        3623     3634      +11     
  Branches     3623     3634      +11     
==========================================
+ Hits         1212     1219       +7     
- Misses       2402     2406       +4     
  Partials        9        9              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.