Overcoming the Challenges of Debugging Containers - Jose Blanquicet
summary
Shows an eBPF-based debugger that turns BCC and raw kernel events into container-aware BCC filters, correlates events with container metadata and the container runtime, and extends from Kubernetes to standalone Docker/containerd/CRI-O/podman with the new ig tool. Demonstrates tracing of process creation, file access, TCP connect/accept/close and disk I O, uses mnt and network namespaces to attribute events, adds synchronised monitoring so startup events are not missed, ships as OCI-packaged gadgets and is accepted into the CNCF sandbox.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker background
- 1:06What is eBPF and observability
- 4:39Challenges with containers in Kubernetes
- 10:02First solution with Inspector Gadget
- 12:06Enhancing Inspector Gadget for Kubernetes
- 13:35Developing custom gadgets
- 16:29Expanding beyond Kubernetes
- 20:02Unified container and process monitoring
- 21:51Containerized gadgets for custom eBPF code
- 25:24Future vision for Inspector Gadget
- 27:12Q&A session
related talks
20mDebugging Kubernetes and Container Workloads with the Superpower of eBPF
26mImplementing Container Privilege Escalation Detection using eBPF for Cloud Native Security
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
25mDebugging at Scale in Production with kubectl debug
46mReal World Debugging with eBPF
34mDebugging at Scale in Production - Deep into Your Containers with Kubectl Debug
30mObservability in Kubernetes: Unlocking the Power of eBPF
36mBumbleBee: Or How I Learned To Stop Worrying And Love eBPF