mirror of
https://github.com/netbirdio/gvisor.git
synced 2026-05-22 17:12:49 -07:00
Add landing page for Runtime Monitoring
PiperOrigin-RevId: 471033778
This commit is contained in:
Fabricio Voznika
committed by
gVisor bot
gVisor bot
parent
00ba42d282
commit
1aad72663a
+51
-43
@@ -13,6 +13,57 @@ doc(
|
||||
weight = "0",
|
||||
)
|
||||
|
||||
doc(
|
||||
name = "install",
|
||||
src = "install.md",
|
||||
category = "User Guide",
|
||||
permalink = "/docs/user_guide/install/",
|
||||
weight = "10",
|
||||
)
|
||||
|
||||
doc(
|
||||
name = "production",
|
||||
src = "production.md",
|
||||
category = "User Guide",
|
||||
data = [
|
||||
"sandboxing-tradeoffs.png",
|
||||
],
|
||||
permalink = "/docs/user_guide/production/",
|
||||
weight = "20",
|
||||
)
|
||||
|
||||
doc(
|
||||
name = "platforms",
|
||||
src = "platforms.md",
|
||||
category = "User Guide",
|
||||
permalink = "/docs/user_guide/platforms/",
|
||||
weight = "30",
|
||||
)
|
||||
|
||||
doc(
|
||||
name = "filesystem",
|
||||
src = "filesystem.md",
|
||||
category = "User Guide",
|
||||
permalink = "/docs/user_guide/filesystem/",
|
||||
weight = "40",
|
||||
)
|
||||
|
||||
doc(
|
||||
name = "networking",
|
||||
src = "networking.md",
|
||||
category = "User Guide",
|
||||
permalink = "/docs/user_guide/networking/",
|
||||
weight = "50",
|
||||
)
|
||||
|
||||
doc(
|
||||
name = "runtime_monitoring",
|
||||
src = "runtime_monitoring.md",
|
||||
category = "User Guide",
|
||||
permalink = "/docs/user_guide/runtimemonitor/",
|
||||
weight = "55",
|
||||
)
|
||||
|
||||
doc(
|
||||
name = "checkpoint_restore",
|
||||
src = "checkpoint_restore.md",
|
||||
@@ -36,46 +87,3 @@ doc(
|
||||
permalink = "/docs/user_guide/faq/",
|
||||
weight = "90",
|
||||
)
|
||||
|
||||
doc(
|
||||
name = "filesystem",
|
||||
src = "filesystem.md",
|
||||
category = "User Guide",
|
||||
permalink = "/docs/user_guide/filesystem/",
|
||||
weight = "40",
|
||||
)
|
||||
|
||||
doc(
|
||||
name = "networking",
|
||||
src = "networking.md",
|
||||
category = "User Guide",
|
||||
permalink = "/docs/user_guide/networking/",
|
||||
weight = "50",
|
||||
)
|
||||
|
||||
doc(
|
||||
name = "install",
|
||||
src = "install.md",
|
||||
category = "User Guide",
|
||||
permalink = "/docs/user_guide/install/",
|
||||
weight = "10",
|
||||
)
|
||||
|
||||
doc(
|
||||
name = "platforms",
|
||||
src = "platforms.md",
|
||||
category = "User Guide",
|
||||
permalink = "/docs/user_guide/platforms/",
|
||||
weight = "30",
|
||||
)
|
||||
|
||||
doc(
|
||||
name = "production",
|
||||
src = "production.md",
|
||||
category = "User Guide",
|
||||
data = [
|
||||
"sandboxing-tradeoffs.png",
|
||||
],
|
||||
permalink = "/docs/user_guide/production/",
|
||||
weight = "20",
|
||||
)
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
# Runtime Monitoring
|
||||
|
||||
The runtime monitoring feature provides an interface to observe runtime behavior
|
||||
of applications running inside gVisor. Although it can be used for many
|
||||
purposes, it was built with the primary focus on threat detection. Out of the
|
||||
box, gVisor comes with support to stream application actions (called trace
|
||||
points) to an external process, that is used to validate the actions and alert
|
||||
when abnormal behavior is detected. Trace points are available for all syscalls
|
||||
and other important events in the system, e.g. container start. More trace
|
||||
points can be easily added as needed. The trace points are sent to a process
|
||||
running alongside the sandbox, which is isolated from the sandbox for security
|
||||
reasons. Additionally, the monitoring process can be shared by many sandboxes.
|
||||
|
||||
You can use the following links to learn more:
|
||||
|
||||
* [Overview](https://github.com/google/gvisor/blob/master/pkg/sentry/seccheck/README.md)
|
||||
* [How to implement a monitoring process](https://github.com/google/gvisor/blob/master/pkg/sentry/seccheck/sinks/remote/README.md)
|
||||
* [Design document](https://docs.google.com/document/d/1RQQKzeFpO-zOoBHZLA-tr5Ed_bvAOLDqgGgKhqUff2A)
|
||||
* [Configuring Falco with gVisor](https://gvisor.dev/docs/tutorials/falco/)
|
||||
* [Tracereplay tool for testing](https://github.com/google/gvisor/blob/master/tools/tracereplay/README.md)
|
||||
@@ -1,10 +1,13 @@
|
||||
# Introduction
|
||||
|
||||
The remote sink implements a protocol that allows a remote process to receive a
|
||||
stream of trace points being triggered inside the sandbox. The remote sink uses
|
||||
Unix-domain socket (UDS) to connect to the remote process. The remote process is
|
||||
expected to have already created the UDS and be listening to new connections.
|
||||
This allows for a single process to monitor all sandboxes in the machine and
|
||||
The remote sink implements a protocol that allows remote processes to monitor
|
||||
actions being taken inside the sandbox. This document provides information
|
||||
required to implement a monitoring process that consumes trace points. The
|
||||
remote sink uses a Unix-domain socket (UDS) for communication. It opens a new
|
||||
connection and sends a stream of trace points being triggered inside the sandbox
|
||||
to the monitoring process. The monitoring process is expected to have already
|
||||
created the UDS and be listening for new connections. This allows for a single
|
||||
process to monitor all sandboxes in the machine, for better resource usage, and
|
||||
simplifies lifecycle management. When a new sandbox starts, it creates a new
|
||||
connection. And when a sandbox exits, the connection is terminated.
|
||||
|
||||
|
||||
@@ -157,6 +157,7 @@ docs(
|
||||
"//g3doc/user_guide:networking",
|
||||
"//g3doc/user_guide:platforms",
|
||||
"//g3doc/user_guide:production",
|
||||
"//g3doc/user_guide:runtime_monitoring",
|
||||
"//g3doc/user_guide/containerd:configuration",
|
||||
"//g3doc/user_guide/containerd:containerd_11",
|
||||
"//g3doc/user_guide/containerd:quick_start",
|
||||
|
||||
Reference in New Issue
Block a user