feat: support docker container allowlist #3827
Open
+56
−31
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds a whitelist feature for docker containers similar to that supported by the
raw_cgroup_prefix_whitelistflag. The code is written in a way such that the same feature can be later added to other plugins (e.g podman, containerd etc).Example use with Docker container IDs:
--docker_id_prefix_whitelist=412a30bf29e6,82e3a4670a41,5f338e361e94Summary of changes:
cmd/cadvisor.go: Addeddocker_id_prefix_whitelistflag. Create awhiteListsmap that aggregates all whitelists and pass it to the manager constructor (New()).manager/manager.go: UpdatedNew()andmanager{}to store thewhiteListsmap and pass it to the plugin initializer and the raw cgroups whitelist toraw.Register().container/factory.go: UpdatedInitializePlugins()to usewhiteListsfor every plugin registration function.container/*/plugin.go: Updated the plugin registration functions to receive the whitelists.container/docker/factory.go: Stored whitelist indockerFactory{}, and updatedCanHandleAndAccept()to filter based on the whitelist. The whitelist feature can be enabled for other plugins by modifying theirfactory.gofiles the same way.