runtime hooks support for tetragon

api/go.mod

@@ -16,7 +16,7 @@ require (
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/kr/pretty v0.3.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	golang.org/x/net v0.0.0-20220615171555-694bf12d69de // indirect
+	golang.org/x/net v0.0.0-20220722155237-a158d28d115b // indirect
 	golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec // indirect
 	golang.org/x/text v0.3.7 // indirect
 	google.golang.org/genproto v0.0.0-20220628213854-d9e0b6570c03 // indirect

api/go.sum

@@ -86,8 +86,8 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.0.0-20220615171555-694bf12d69de h1:ogOG2+P6LjO2j55AkRScrkB2BFpd+Z8TY2wcM0Z3MGo=
-golang.org/x/net v0.0.0-20220615171555-694bf12d69de/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b h1:PxfKdU9lEEDYjdIzOtC4qFWgkU2rGHdKlKowJSMN9h0=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

api/v1/README.md

@@ -9,6 +9,8 @@
 - [tetragon/tetragon.proto](#tetragon_tetragon-proto)
     - [Capabilities](#tetragon-Capabilities)
     - [Container](#tetragon-Container)
+    - [CreateContainer](#tetragon-CreateContainer)
+    - [CreateContainer.AnnotationsEntry](#tetragon-CreateContainer-AnnotationsEntry)
     - [GetHealthStatusRequest](#tetragon-GetHealthStatusRequest)
     - [GetHealthStatusResponse](#tetragon-GetHealthStatusResponse)
     - [HealthStatus](#tetragon-HealthStatus)
@@ -35,6 +37,8 @@
     - [ProcessKprobe](#tetragon-ProcessKprobe)
     - [ProcessLoader](#tetragon-ProcessLoader)
     - [ProcessTracepoint](#tetragon-ProcessTracepoint)
+    - [RuntimeHookRequest](#tetragon-RuntimeHookRequest)
+    - [RuntimeHookResponse](#tetragon-RuntimeHookResponse)
     - [Test](#tetragon-Test)
 
     - [HealthStatusResult](#tetragon-HealthStatusResult)
@@ -198,6 +202,42 @@
 
 
 
+<a name="tetragon-CreateContainer"></a>
+
+### CreateContainer
+CreateContainer informs the agent that a container was created
+This is intented to be used by OCI hooks (but not limited to them) and corresponds to the
+CreateContainer hook:
+https://github.com/opencontainers/runtime-spec/blob/main/config.md#createcontainer-hooks.
+
+
+| Field | Type | Label | Description |
+| ----- | ---- | ----- | ----------- |
+| cgroupsPath | [string](#string) |  | cgroupsPath is the cgroups path for the container. The path is expected to be relative to the cgroups mountpoint. See: https://github.com/opencontainers/runtime-spec/blob/58ec43f9fc39e0db229b653ae98295bfde74aeab/specs-go/config.go#L174 |
+| rootDir | [string](#string) |  | rootDir is the absolute path of the root directory of the container. See: https://github.com/opencontainers/runtime-spec/blob/main/specs-go/config.go#L174 |
+| annotations | [CreateContainer.AnnotationsEntry](#tetragon-CreateContainer-AnnotationsEntry) | repeated | annotations are the run-time annotations for the container see https://github.com/opencontainers/runtime-spec/blob/main/config.md#annotations |
+
+
+
+
+
+
+<a name="tetragon-CreateContainer-AnnotationsEntry"></a>
+
+### CreateContainer.AnnotationsEntry
+
+
+
+| Field | Type | Label | Description |
+| ----- | ---- | ----- | ----------- |
+| key | [string](#string) |  |  |
+| value | [string](#string) |  |  |
+
+
+
+
+
+
 <a name="tetragon-GetHealthStatusRequest"></a>
 
 ### GetHealthStatusRequest
@@ -691,6 +731,31 @@ loader sensor event triggered for loaded binary/library
 
 
 
+<a name="tetragon-RuntimeHookRequest"></a>
+
+### RuntimeHookRequest
+RuntimeHookRequest synchronously propagates information to the agent about run-time state.
+
+
+| Field | Type | Label | Description |
+| ----- | ---- | ----- | ----------- |
+| createContainer | [CreateContainer](#tetragon-CreateContainer) |  |  |
+
+
+
+
+
+
+<a name="tetragon-RuntimeHookResponse"></a>
+
+### RuntimeHookResponse
+
+
+
+
+
+
+
 <a name="tetragon-Test"></a>
 
 ### Test
@@ -1321,6 +1386,7 @@ Determins the behaviour of a field filter
 | GetSensorConfig | [GetSensorConfigRequest](#tetragon-GetSensorConfigRequest) | [GetSensorConfigResponse](#tetragon-GetSensorConfigResponse) |  |
 | GetStackTraceTree | [GetStackTraceTreeRequest](#tetragon-GetStackTraceTreeRequest) | [GetStackTraceTreeResponse](#tetragon-GetStackTraceTreeResponse) |  |
 | GetVersion | [GetVersionRequest](#tetragon-GetVersionRequest) | [GetVersionResponse](#tetragon-GetVersionResponse) |  |
+| RuntimeHook | [RuntimeHookRequest](#tetragon-RuntimeHookRequest) | [RuntimeHookResponse](#tetragon-RuntimeHookResponse) |  |
 
 
 

api/v1/tetragon/sensors.proto

@@ -108,4 +108,6 @@ service FineGuidanceSensors {
     rpc GetStackTraceTree(GetStackTraceTreeRequest) returns (GetStackTraceTreeResponse) {}
 
     rpc GetVersion(GetVersionRequest) returns (GetVersionResponse) {}
+
+    rpc RuntimeHook(RuntimeHookRequest) returns (RuntimeHookResponse) {}
 }