alttch / pptop Goto Github PK

Hey there! Wonderful tool, love it, been looking for something like this for years.

I had to make a slight tweak to make it work with alpine / musl libc (which is fairly common in docker containers).

The call to __libc_dlopen_mode() is glibc specific (as far as i can see, a workaround for the fact that libdl is not always loaded?), with musl you should just do dlopen().

I don't have a clean patch for this (that doesn't break glibc and tries to detect musl somehow), but wanted to post the issue to not forget.

Cheers

Nice work, thanks so much for making this!

(out of curiosity, any hope for macOS support someday? does it rely on strace/can it use dtrace instead on mac? feel free to close this issue)

Setup:

• Docker for Mac
• Target: Running container with datadog-agent (Python 3.8 embedded process):

docker run --rm -d \
           --name dd-agent \
           --net host \
           -e DD_API_KEY="fake" \
           -v /proc/:/host/proc/:ro \
           -v /sys/fs/cgroup/:/host/sys/fs/cgroup:ro \
           -v /var/run/docker.sock:/var/run/docker.sock:ro \
           -v /opt/datadog-agent/run:/opt/datadog-agent/run:rw \
           datadog/agent

Attachment container (some flags aren't needed - was using this for debugging):

$ docker run --rm -it \
           --name="devenv" \
           --pid="container:dd-agent" \
           --cap-add="SYS_PTRACE" \
           --cap-add="SYS_ADMIN" \
           --privileged \
           --security-opt="seccomp=unconfined" \
           --security-opt="apparmor=unconfined" \
           ubuntu:21.10

Running:

$ apt update && apt install -y gdb python3-pip
$ pip3 install pptop

$ agent_pid=$(ps -ef | grep 'agent run$' | awk '{print $2}')

$ 
pptop $agent_pid
b'No symbol "__pptop_start_injection" in current context.\n'