rahultoppurandLucas Manuel Rodriguez
06bc81106e
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #48006. Adds a new field `socket_path` in both `containerd_containers` and `containerd_mounts`. We keep the previous default when no `socket_path` is requested in the filter; otherwise, we honor the value passed from the incoming query. Test case: Ran a `make fleetd-tables-linux`, started some containers, then used osquery: <img width="2494" height="1408" alt="Screenshot from 2026-06-22 12-48-43" src="https://github.com/user-attachments/assets/ed65d16c-8aa8-4fc7-890e-4f200752e6e2" /> # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops - [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing - [ ] Added/updated automated tests - [ ] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [ ] Confirmed that the fix is not expected to adversely impact load test results - [ ] Alerted the release DRI if additional load testing is needed ## Database migrations - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [ ] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [ ] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). ## New Fleet configuration settings - [ ] Setting(s) is/are explicitly excluded from GitOps If you didn't check the box above, follow this checklist for GitOps-enabled settings: - [ ] Verified that the setting is exported via `fleetctl generate-gitops` - [ ] Verified the setting is documented in a separate PR to [the GitOps documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485) - [ ] Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional) - [ ] Verified that any relevant UI is disabled when GitOps mode is enabled ## fleetd/orbit/Fleet Desktop - [ ] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [ ] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [ ] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added an optional `socket_path` column to `containerd_containers` and `containerd_mounts`. * Containerd queries can now target a specific socket path, and results report the socket path used (defaulting to `/run/containerd/containerd.sock` when not provided). * **Documentation** * Updated Fleet and table schemas with the new `socket_path` column and example queries (including common k3s socket paths). * **Tests** * Added Linux-only coverage to verify default vs explicitly provided `socket_path` behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Lucas Manuel Rodriguez <lucarodriguez@gmail.com>
Hello! Welcome to Fleet's osquery tables documentation.
This folder contains additional documentation that we add on top of the existing documentation for osquery to make the documentation of each table more useful for Fleet users.
Fleet's schema tables live in the tables/ folder. Each osquery table with Fleet overrides has a corresponding YAML file that will override information in the osquery schema documentation.
The existing documentation data lives in the osquery repo at: https://github.com/osquery/osquery-site/tree/source/src/data/osquery_schema_versions.
You can open PRs against a table's YAML file in the tables/ folder or the osquery schema file. Just note that the data in a table's YAML file overwrites the osquery data whenever there is a conflict:
-
Clone the fleetdm/fleet repository.
-
Add or modify the table's YAML file, move to the
websitedirectory in the project root and runnode ./node_modules/sails/bin/sails run generate-merged-schemato generate the merged JSON schema.
Alternatively, you can find the table's page on the Fleet website and click the "edit page" button.
When adding a new table or overriding an existing table use this template:
name: # (required) string - The name of the table.
evented: # boolean - whether or not this table is evented. This value may be required depending on the table's source.
description: |- # (required) string - The description for this table. Note: this field supports markdown
# Add description here
examples: |- # (optional) string - An example query for this table. Note: This field supports markdown
# Add examples here
notes: |- # (optional) string - Notes about this table. Note: This field supports markdown.
# Add notes here
platforms: |- # (optional) array - A list of supported platforms for this table (any of: `darwin`, `windows`, `linux`, `chrome`)
# Add platforms here
columns: # (required) array - An array of columns in this table
- name: # (required) string - The name of the column
description: # (required) string - The column's description
type: # (required) string - the column's data type
required: # (required) boolean - whether or not this column is required to query this table.
platforms: # (optional) array - List of supported platforms, used to clarify when a column isn't available on every platform its table supports (any of: `darwin`, `windows`, `linux`, `chrome`)