Loading…
Attending this event?
Saturday, January 25 • 5:00pm - 5:25pm
Traceloop: Tracing containers syscalls using BPF

Sign up or log in to save this to your schedule and see who's attending!

I will present traceloop, a tracing tool to trace system calls in cgroups or in containers using BPF and overwritable ring buffers.

Many people use the “strace” tool to synchronously trace system calls using ptrace. Traceloop similarly traces system calls but asynchronously in the background, using BPF and tracing per cgroup. I’ll show how it can be integrated with systemd and with Kubernetes via Inspektor Gadget.

Traceloop's traces are recorded in a fast, in-memory, overwritable ring buffer like a flight recorder. As opposed to “strace”, the tracing could be permanently enabled on systemd services or Kubernetes pods and inspected in case of a crash. This is like a always-on “strace in the past”.

Traceloop uses BPF through the gobpf library. Several new features have been added in gobpf for the needs of traceloop: support for overwritable ring buffers and swapping buffers when the userspace utility dumps the buffer.

https://github.com/kinvolk/traceloop

Speakers
avatar for Alban Crequy

Alban Crequy

CTO, Kinvolk
Originally from France, Alban currently lives in Berlin where he is a CTO & co-founder at Kinvolk. He is a contributor to rkt, a container runtime for Linux, Weave Scope, a container visualization & monitoring tool, and is actively working on BPF-related projects. Before falling into... Read More →


Saturday January 25, 2020 5:00pm - 5:25pm
E112 Faculty of Information Technology Brno University of Technology, Božetěchova, Brno-Královo Pole, Czechia

Attendees (23)