Commitfd372f6

authored

fix(cli/clistat): improve detection of container environment (#8643)

Use the presence of /var/run/secrets/kubernetes.io/serviceaccount/token to determine if we are in a container in addition to sniffing /proc/1/cgroup

1 parent87d5cda commitfd372f6Copy full SHA for fd372f6

File tree

+12

-3

lines changed

+12

-3

lines changed

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -338,7 +338,7 @@ func readInt64Prefix(fs afero.Fs, path, prefix string) (int64, error) {`
`338`	`338`
`339`	`339`	`scn:=bufio.NewScanner(bytes.NewReader(data))`
`340`	`340`	`forscn.Scan() {`
`341`		`-line:=scn.Text()`
	`341`	`+line:=strings.TrimSpace(scn.Text())`
`342`	`342`	`if!strings.HasPrefix(line,prefix) {`
`343`	`343`	`continue`
`344`	`344`	`}`

Lines changed: 11 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -10,8 +10,9 @@ import (`
`10`	`10`	`)`
`11`	`11`
`12`	`12`	`const (`
`13`		`-procMounts="/proc/mounts"`
`14`		`-procOneCgroup="/proc/1/cgroup"`
	`13`	`+procMounts="/proc/mounts"`
	`14`	`+procOneCgroup="/proc/1/cgroup"`
	`15`	`+kubernetesDefaultServiceAccountToken="/var/run/secrets/kubernetes.io/serviceaccount/token"//nolint:gosec`
`15`	`16`	`)`
`16`	`17`
`17`	`18`	`// IsContainerized returns whether the host is containerized.`
`@@ -38,6 +39,14 @@ func IsContainerized(fs afero.Fs) (ok bool, err error) {`
`38`	`39`	`}`
`39`	`40`	`}`
`40`	`41`
	`42`	`+// Sometimes the above method of sniffing /proc/1/cgroup isn't reliable.`
	`43`	`+// If a Kubernetes service account token is present, that's`
	`44`	`+// also a good indication that we are in a container.`
	`45`	`+_,err=afero.ReadFile(fs,kubernetesDefaultServiceAccountToken)`
	`46`	`+iferr==nil {`
	`47`	`+returntrue,nil`
	`48`	`+}`
	`49`	`+`
`41`	`50`	`// Last-ditch effort to detect Sysbox containers.`
`42`	`51`	`// Check if we have anything mounted as type sysboxfs in /proc/mounts`
`43`	`52`	`mountsData,err:=afero.ReadFile(fs,procMounts)`

Comments

(0)