Tracer namespaces
summary
Proposes attaching per-namespace ring buffers so each container namespace gets its own ring and events are serialized into buffers up the hierarchy via hierarchical dispatch instead of expensive global filtering; supports kernel syscall tracing, uprobes/uprobes-like user events and libtracepoint instrumentation, but notes eBPF programs are often blocked inside containers and cannot be attached there. Raises resource-control gaps: how to charge/limit buffer memory (cgroups creation timing and expandable vs fixed buffers), and debates TraceFS "make dir" namespaces versus piggybacking on the existing user namespace for visibility and permissions.
AI-written summary · about
chapters (7)
- 0:00Introduction to tracer namespaces
- 6:24Discussion on namespace solutions
- 10:16Resource control for ring buffers
- 15:42Use case and container requirements
- 17:48TraceFS namespace proposal
- 22:02User events and upstream status
- 24:31Performance and security concerns
related talks
22mTraceloop: Tracing containers syscalls using BPF
25mKernel tracing with BPF
50mIntroduction to eBPF
35mLinux Tracing updates
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
25mAn introduction to bpftrace tracing language
46mReal World Debugging with eBPF
47mLinux user namespaces: a blessing and a curse