Container/netns-aware capture + cgroup attribution #126

New issue

Closed

opened 2026-07-03 06:30:03 +00:00 by p13marc · 1 comment

p13marc commented

2026-07-03 06:30:03 +00:00

(Migrated from github.com)

Roadmap. Forward-looking; possibly breaking on the capture-target API. Correlation-relevant.

Problem

Capture is by interface name only — no network-namespace entry, no container/cgroup tagging. In containerized hosts this misses per-container traffic and can't attribute flows to a workload. AnyBackend selects an interface; there's no netns/cgroup dimension.

Proposal

Capture-target API that can enter a netns (by name / pid / path) before opening the socket, and tag events with the netns identity.
Optionally stamp cgroup id on flows where available (pairs with socket cgroup_id on the netlink side) → container attribution.
Frontier note: netkit (kernel 6.7, BPF-programmable veth) is the emerging container device type worth accounting for.

Impact

Unlocks container-scoped NDR and feeds ZenSight's host/container entity resolution (correlation epic C9).

**Roadmap.** Forward-looking; possibly breaking on the capture-target API. Correlation-relevant. ## Problem Capture is by interface name only — no network-namespace entry, no container/cgroup tagging. In containerized hosts this misses per-container traffic and can't attribute flows to a workload. `AnyBackend` selects an interface; there's no `netns`/cgroup dimension. ## Proposal - Capture-target API that can enter a netns (by name / pid / path) before opening the socket, and tag events with the netns identity. - Optionally stamp cgroup id on flows where available (pairs with socket cgroup_id on the netlink side) → container attribution. - Frontier note: **netkit** (kernel 6.7, BPF-programmable veth) is the emerging container device type worth accounting for. ## Impact Unlocks container-scoped NDR and feeds ZenSight's host/container entity resolution (correlation epic C9).

p13marc commented

2026-07-03 21:49:33 +00:00

(Migrated from github.com)

Done in 3156e41 (0.29.0). NetNs handle (from_name/from_pid/from_path/current, label/inode/try_clone) + scoped-thread run_in(..) (setns CLONE_NEWNET, no restore — thread exits; fds are netns-independent), and CaptureBuilder::netns(&NetNs) for AF_PACKET capture inside a namespace. Requires CAP_SYS_ADMIN. Monitor-level CaptureTarget/SourceMeta plumbing + cgroup stamping (folds into #130) + AF_XDP-in-netns are documented follow-ups.

Done in `3156e41` (0.29.0). `NetNs` handle (from_name/from_pid/from_path/current, label/inode/try_clone) + scoped-thread `run_in(..)` (setns CLONE_NEWNET, no restore — thread exits; fds are netns-independent), and `CaptureBuilder::netns(&NetNs)` for AF_PACKET capture inside a namespace. Requires CAP_SYS_ADMIN. Monitor-level CaptureTarget/SourceMeta plumbing + cgroup stamping (folds into #130) + AF_XDP-in-netns are documented follow-ups.