Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 38 Packages Projects Releases Wiki Activity

Add socket_path to containerd tables (#47987)

Browse Source 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #48006.

Adds a new field `socket_path` in both `containerd_containers` and
`containerd_mounts`. We keep the previous default when no `socket_path`
is requested in the filter; otherwise, we honor the value passed from
the incoming query.

Test case:

Ran a `make fleetd-tables-linux`, started some containers, then used
osquery:

<img width="2494" height="1408" alt="Screenshot from 2026-06-22
12-48-43"
src="https://github.com/user-attachments/assets/ed65d16c-8aa8-4fc7-890e-4f200752e6e2"
/>


# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Summary by CodeRabbit

* **New Features**
* Added an optional `socket_path` column to `containerd_containers` and
`containerd_mounts`.
* Containerd queries can now target a specific socket path, and results
report the socket path used (defaulting to
`/run/containerd/containerd.sock` when not provided).

* **Documentation**
* Updated Fleet and table schemas with the new `socket_path` column and
example queries (including common k3s socket paths).

* **Tests**
* Added Linux-only coverage to verify default vs explicitly provided
`socket_path` behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Lucas Manuel Rodriguez <lucarodriguez@gmail.com>
This commit is contained in:
rahultoppur
2026-06-23 10:21:07 -03:00
committed by GitHub
co-authored by Lucas Manuel Rodriguez
parent 977d8e8d73
commit 06bc81106e
8 changed files with 112 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
orbit/changes/48006-queryable-socket-path
+2
View File
@@ -0,0 +1,2 @@
* Adds an optional, queryable socket_path column to both containerd_containers and containerd_mounts.
* Defaults to /run/containerd/containerd.sock when no value is specified, maintaining backwards compatibility.
orbit/pkg/table/containerd/containerd_linux.go
+30
View File
@@ -0,0 +1,30 @@
//go:build linux
package containerd
import (
"github.com/containerd/containerd"
"github.com/fleetdm/fleet/v4/orbit/pkg/table/tablehelpers"
"github.com/osquery/osquery-go/plugin/table"
)
const (
defaultSocketPath = "/run/containerd/containerd.sock"
socketPathCol = "socket_path"
)
// resolveSocketPath fetches socket path from the query context.
func resolveSocketPath(queryContext table.QueryContext) string {
paths := tablehelpers.GetConstraints(queryContext, socketPathCol, tablehelpers.WithDefaults(defaultSocketPath))
if len(paths) == 0 {
return defaultSocketPath
}
return paths[0]
}
// newClient wraps the creation of containerd.Client to handle the socket path.
func newClient(queryContext table.QueryContext) (*containerd.Client, string, error) {
sp := resolveSocketPath(queryContext)
client, err := containerd.New(sp)
return client, sp, err
}
orbit/pkg/table/containerd/containerd_linux_test.go
+38
View File
@@ -0,0 +1,38 @@
//go:build linux
package containerd
import (
"testing"
"github.com/fleetdm/fleet/v4/orbit/pkg/table/tablehelpers"
"github.com/stretchr/testify/require"
)
func TestSocketPath(t *testing.T) {
t.Parallel()
tests := []struct {
name string
constraints map[string][]string
expected string
}{
{
name: "return legacy default",
constraints: nil,
expected: defaultSocketPath,
},
{
name: "return explicit socket",
constraints: map[string][]string{socketPathCol: {"/run/k3s/containerd/containerd.sock"}},
expected: "/run/k3s/containerd/containerd.sock",
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
t.Parallel()
require.Equal(t, tt.expected, resolveSocketPath(tablehelpers.MockQueryContext(tt.constraints)))
})
}
}
orbit/pkg/table/containerd/containers_linux.go
+3 -2
View File
@@ -7,7 +7,6 @@ import (
"fmt"
"strings"
"github.com/containerd/containerd"
"github.com/containerd/containerd/cio"
"github.com/containerd/containerd/namespaces"
"github.com/osquery/osquery-go/plugin/table"
@@ -26,13 +25,14 @@ func ContainersColumns() []table.ColumnDefinition {
table.TextColumn("runtime"),
table.TextColumn("command"),
table.BigIntColumn("pid"),
table.TextColumn("socket_path"),
}
}
// GenerateContainers is called to return the results for the containerd_containers table at query time.
// Constraints for generating can be retrieved from the queryContext.
func GenerateContainers(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) {
client, err := containerd.New("/run/containerd/containerd.sock")
client, socketPath, err := newClient(queryContext)
if err != nil {
return nil, fmt.Errorf("Failed to connect to containerd: %v", err)
}
@@ -100,6 +100,7 @@ func GenerateContainers(ctx context.Context, queryContext table.QueryContext) ([
"runtime": info.Runtime.Name,
"pid": pid,
"command": command,
"socket_path": socketPath,
}
rows = append(rows, row)
}
orbit/pkg/table/containerd/mounts_linux.go
+3 -2
View File
@@ -7,7 +7,6 @@ import (
"fmt"
"strings"
"github.com/containerd/containerd"
"github.com/containerd/containerd/namespaces"
"github.com/osquery/osquery-go/plugin/table"
"github.com/rs/zerolog/log"
@@ -22,13 +21,14 @@ func MountsColumns() []table.ColumnDefinition {
table.TextColumn("source"),
table.TextColumn("destination"),
table.TextColumn("options"),
table.TextColumn("socket_path"),
}
}
// GenerateMounts is called to return the results for the containerd_mounts table at query time.
// Constraints for generating can be retrieved from the queryContext.
func GenerateMounts(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) {
client, err := containerd.New("/run/containerd/containerd.sock")
client, socketPath, err := newClient(queryContext)
if err != nil {
return nil, fmt.Errorf("Failed to connect to containerd: %w", err)
}
@@ -67,6 +67,7 @@ func GenerateMounts(ctx context.Context, queryContext table.QueryContext) ([]map
"source": mount.Source,
"destination": mount.Destination,
"options": strings.Join(mount.Options, ","),
"socket_path": socketPath,
}
rows = append(rows, row)
}
schema/osquery_fleet_schema.json
+14 -2
View File
@@ -4776,9 +4776,15 @@
"type": "integer",
"required": false,
"description": "PID of the container process."
},
{
"name": "socket_path",
"type": "text",
"required": false,
"description": "Path to the containerd socket to query (default: /run/containerd/containerd.sock)."
}
],
"examples": "Get all containers from all namespaces:\n\n```\nSELECT * FROM containerd_containers;\n```\n\nGet only running containers in the `default` namespace:\n\n```\nSELECT * FROM containerd_containers WHERE namespace='default' AND state='running';\n```",
"examples": "Get all containers from all namespaces:\n\n```\nSELECT * FROM containerd_containers;\n```\n\nGet only running containers in the `default` namespace:\n\n```\nSELECT * FROM containerd_containers WHERE namespace='default' AND state='running';\n```\n\nQuery containers from a k3s containerd socket:\n\n```\nSELECT * FROM containerd_containers WHERE socket_path = '/run/k3s/containerd/containerd.sock';\n```",
"notes": "This table is not a core osquery table. It is included as part of Fleet's agent\n([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)).\n\nThe `containerd` table is available on Linux systems with containerd installed. It provides\ninformation about the containers managed by containerd, including their state, image, and runtime.\n\nThis table is useful for systems using containerd as a container runtime, such as those running\nKubernetes. See the `docker_containers` table for information about containers managed by Docker.",
"url": "https://fleetdm.com/tables/containerd_containers",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/containerd_containers.yml"
@@ -4826,9 +4832,15 @@
"type": "text",
"required": false,
"description": "Mount options (comma-separated)."
},
{
"name": "socket_path",
"type": "text",
"required": false,
"description": "Path to the containerd socket to query (default: /run/containerd/containerd.sock)."
}
],
"examples": "Get all mounts for all containers:\n\n```\nSELECT * FROM containerd_mounts;\n```\n\nGet mounts for a specific container:\n\n```\nSELECT * FROM containerd_mounts WHERE container_id='abc123';\n```\n\nGet all bind mounts:\n\n```\nSELECT * FROM containerd_mounts WHERE type='bind';\n```",
"examples": "Get all mounts for all containers:\n\n```\nSELECT * FROM containerd_mounts;\n```\n\nGet mounts for a specific container:\n\n```\nSELECT * FROM containerd_mounts WHERE container_id='abc123';\n```\n\nGet all bind mounts:\n\n```\nSELECT * FROM containerd_mounts WHERE type='bind';\n```\n\nQuery mounts from a k3s containerd socket:\n\n```\nSELECT * FROM containerd_mounts WHERE socket_path = '/run/k3s/containerd/containerd.sock';\n```",
"notes": "This table is not a core osquery table. It is included as part of Fleet's agent\n([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)).\n\nThe `containerd_mounts` table is available on Linux systems with containerd installed. It provides\ninformation about the mounts configured for containers managed by containerd.\n\nThis table is useful for systems using containerd as a container runtime, such as those running\nKubernetes. See the `docker_container_mounts` table for information about mounts in Docker containers.",
"url": "https://fleetdm.com/tables/containerd_mounts",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/containerd_mounts.yml"
schema/tables/containerd_containers.yml
+11
View File
@@ -49,6 +49,11 @@ columns:
required: false
description: |-
PID of the container process.
- name: socket_path
type: text
required: false
description: |-
Path to the containerd socket to query (default: /run/containerd/containerd.sock).
examples: |-
Get all containers from all namespaces:
@@ -61,6 +66,12 @@ examples: |-
```
SELECT * FROM containerd_containers WHERE namespace='default' AND state='running';
```
Query containers from a k3s containerd socket:
```
SELECT * FROM containerd_containers WHERE socket_path = '/run/k3s/containerd/containerd.sock';
```
notes: |-
This table is not a core osquery table. It is included as part of Fleet's agent
schema/tables/containerd_mounts.yml
+11
View File
@@ -34,6 +34,11 @@ columns:
required: false
description: |-
Mount options (comma-separated).
- name: socket_path
type: text
required: false
description: |-
Path to the containerd socket to query (default: /run/containerd/containerd.sock).
examples: |-
Get all mounts for all containers:
@@ -53,6 +58,12 @@ examples: |-
SELECT * FROM containerd_mounts WHERE type='bind';
```
Query mounts from a k3s containerd socket:
```
SELECT * FROM containerd_mounts WHERE socket_path = '/run/k3s/containerd/containerd.sock';
```
notes: |-
This table is not a core osquery table. It is included as part of Fleet's agent
([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)).