Traceloop: Tracing containers syscalls using BPF
summary
traceloop traces syscalls per cgroup or container asynchronously using BPF, recording events into an overwritable ring buffer so traces act like an always‑on flight recorder inspectable after a crash. It integrates with systemd and Kubernetes via Inspektor Gadget, uses gobpf with new support for overwritable buffers and buffer swapping, and can drop events if the ring buffer overruns or if syscall args live on unmapped pages. It works on Flatcar, Minikube and GKE but needs cgroup v2/workarounds to map pods by namespace/labels.
AI-written summary · about
chapters (10)
- 0:00Introduction to trace loop
- 1:07BPF and tracing tools
- 3:05The flight recorder concept
- 4:29Trace loop vs strace
- 6:21System design architecture
- 8:08Tracing demo and usage
- 10:04Integration with Kubernetes
- 13:25Development challenges
- 16:09Stopgaps and solutions
- 18:53Q&A and limitations
related talks
30mInspektor Gadget and traceloop: BPF debugging tools for Kubernetes
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
25mTracer namespaces
25mKernel tracing with BPF
20mDebugging Kubernetes and Container Workloads with the Superpower of eBPF
30mMix Kubernetes with Linux Kernel Tracing to Boost the Observability of Your Cluster
28mbpftrace: what is it, what's new, and where is it going
46mReal World Debugging with eBPF