Communication between independent containers
Techniques related to communication between independent containers are provided. In an embodiment, a first programmatic container includes one or more first namespaces in which an application program is executing. A second programmatic container includes one or more second namespaces in which a monitoring agent is executing. The one or more first namespaces are independent of the one or more second namespaces. A monitoring agent process hosts the monitoring agent. The monitoring agent is programmed to receive an identifier of the application program. The monitoring agent is further programmed to switch the monitoring agent process from the one or more second namespaces to the one or more first namespaces. After the switch, the monitoring agent process continues to execute in the second programmatic container, but communication is enabled between the application program and the monitoring agent via the monitoring agent process.
1. A method comprising:
based on a monitoring process or a subprocess thereof intercepting a system call by a monitoring agent that requires access to a first mount namespace of a first programmatic container, the monitoring process or the subprocess thereof switching from a second mount namespace of a second programmatic container to the first mount namespace;
wherein the monitoring agent and the monitoring process or the subprocess thereof continue to execute in the second programmatic container after the monitoring process or the subprocess thereof switches from the second mount namespace to the first mount namespace;
the monitoring process or the subprocess thereof making the intercepted system call while the monitoring process or the subprocess thereof is switched from the second mount namespace to the first mount namespace;
wherein the monitoring process or the subprocess thereof making the intercepted system call while the monitoring process or the subprocess thereof is switched from the second mount namespace to the first mount namespace causes the monitoring agent to receive one or more monitoring metrics pertaining to an application program executing in the first programmatic container while the monitoring agent executes in the second programmatic container; and
wherein the method is performed by one or more computing devices.
2. The method of claim 1 , further comprising the monitoring process or the subprocess thereof creating a pointer to the intercepted system call while the monitoring process or the subprocess thereof is switched from the second mount namespace to the first mount namespace.
3. The method of claim 1 , wherein the monitoring process or the subprocess thereof is instrumented to intercept the system call by the monitoring agent.
4. The method of claim 1 , wherein the monitoring process or the subprocess thereof is instrumented to intercept the system call by the monitoring agent using a LD_PRELOAD dynamic library injection technique.
5. The method of claim 1 , wherein the system call is one of stat( ), fstat( ), read( ), fread( ), write( ), fwrite( ), getdents( ), or readdir( ).
6. The method of claim 1 , further comprising the monitoring process or the subprocess thereof creating a pointer to the intercepted system call using dlsym( ) and RTLD_NEXT as a pseudo-handle while the monitoring process or the subprocess thereof is switched from the second mount namespace to the first mount namespace.
7. The method of claim 1 , further comprising the monitoring process or the subprocess thereof switching back from the first mount namespace to the second mount namespace.
8. One or more non-transitory storage media storing instructions which, when executed by one or more computing devices, cause performing:
based on a monitoring process or a subprocess thereof intercepting a system call by a monitoring agent that requires access to a first mount namespace of a first programmatic container, the monitoring process or the subprocess thereof switching from a second mount namespace of a second programmatic container to the first mount namespace;
wherein the monitoring agent and the monitoring process or the subprocess thereof continue to execute in the second programmatic container after the monitoring process or the subprocess thereof switches from the second mount namespace to the first mount namespace;
the monitoring process or the subprocess thereof making the intercepted system call while the monitoring process or the subprocess thereof is switched from the second mount namespace to the first mount namespace; and
wherein the monitoring process or the subprocess thereof making the intercepted system call while the monitoring process or the subprocess thereof is switched from the second mount namespace to the first mount namespace causes the monitoring agent to receive one or more monitoring metrics pertaining to an application program executing in the first programmatic container while the monitoring agent executes in the second programmatic container.
9. The one or more non-transitory storage media of claim 8 , further storing instructions which, when executed by the one or more computing devices, cause the monitoring process or the subprocess thereof creating a pointer to the intercepted system call while the monitoring process or the subprocess thereof is switched from the second mount namespace to the first mount namespace.
10. The one or more non-transitory storage media of claim 8 , wherein the monitoring process or the subprocess thereof is instrumented to intercept the system call by the monitoring agent.
11. The one or more non-transitory storage media of claim 8 , wherein the monitoring process or the subprocess thereof is instrumented to intercept the system call by the monitoring agent using a LD_PRELOAD dynamic library injection technique.
12. The one or more non-transitory storage media of claim 8 , wherein the system call is one of stat( ), fstat( ), read( ), fread( ), write( ), fwrite( ), getdents( ), or readdir( ).
13. The one or more non-transitory storage media of claim 8 , further storing instructions which, when executed by the one or more computing devices, cause the monitoring process or the subprocess thereof creating a pointer to the intercepted system call using dlsym( ) and RTLD_NEXT as a pseudo-handle while the monitoring process or the subprocess thereof is switched from the second mount namespace to the first mount namespace.
14. The one or more non-transitory storage media of claim 8 , further storing instructions which, when executed by the one or more computing devices, cause the monitoring process or the subprocess thereof switching back from the first mount namespace to the second mount namespace.
15. A computing system comprising:
one or more processors;
storage media; and
instructions stored in the storage media and which, when executed by the one or more processors, cause performance of:
based on a monitoring process or a subprocess thereof intercepting a system call by a monitoring agent that requires access to a first mount namespace of a first programmatic container, the monitoring process or the subprocess thereof switching from a second mount namespace of a second programmatic container to the first mount namespace;
wherein the monitoring agent and the monitoring process or the subprocess thereof continue to execute in the second programmatic container after the monitoring process or the subprocess thereof switches from the second mount namespace to the first mount namespace;
the monitoring process or the subprocess thereof making the intercepted system call while the monitoring process or the subprocess thereof is switched from the second mount namespace to the first mount namespace; and
wherein the monitoring process or the subprocess thereof making the intercepted system call while the monitoring process or the subprocess thereof is switched from the second mount namespace to the first mount namespace causes the monitoring agent to receive one or more monitoring metrics pertaining to an application program executing in the first programmatic container while the monitoring agent executes in the second programmatic container.
16. The computing system of claim 15 , further comprising instructions which, when executed by the one or more processors, cause performance of the monitoring process or the subprocess thereof creating a pointer to the intercepted system call while the monitoring process or the subprocess thereof is switched from the second mount namespace to the first mount namespace.
17. The computing system of claim 15 , wherein the monitoring process or the subprocess thereof is instrumented to intercept the system call by the monitoring agent.
18. The computing system of claim 15 , wherein the monitoring process or the subprocess thereof is instrumented to intercept the system call by the monitoring agent using a LD_PRELOAD dynamic library injection technique.
19. The computing system of claim 15 , wherein the system call is one of stat( ), fstat( ), read( ), fread( ), write( ), fwrite( ), getdents( ), or readdir( ).
20. The computing system of claim 15 , further comprising instructions which, when executed by the one or more processors, cause performance of the monitoring process or the subprocess thereof creating a pointer to the intercepted system call using dlsym( ) and RTLD_NEXT as a pseudo-handle while the monitoring process or the subprocess thereof is switched from the second mount namespace to the first mount namespace.
21. The computing system of claim 15 , further comprising instructions which, when executed by the one or more processors, cause performance of the monitoring process or the subprocess thereof switching back from the first mount namespace to the second mount namespace.