Skip to content

using killsnoop.bt from inside a docker container? #106

Open
@dothebart

Description

Hi,
I'd like to invoke killsnoop from inside a docker container. I've tried adding:

  --privileged \
  --cap-add=ALL \

to its launch commands, but I still see:

usr/sbin/killsnoop.bt -p 3519776 
ERROR: tracepoint not found: syscalls:sys_enter_kill

I can run it from outside the container, if it launched with --pid=host that can make sense, however, thats just one of my 3 usecases where I need to trap things.

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions