topic Re: Full-stack monitoring of stand alone Podman container using --read-only=True option in Container platforms

Full-stack monitoring of stand alone Podman container using --read-only=True option

gilles_tabary — Mon, 25 Mar 2024 13:54:01 GMT

Hello.

Did any one successfully full-stack monitored stand alone Podman (no ~~platform~~) containers running with --read-only=True option ?

/usr/bin/podman run ...  --read-only=True ...

I have a Linux RHEL host, OneAgent'ed in full-stack mode with Podman container monitoring enabled, running many containers, Ociruntime == crun and Podman version officially supported. But none of my containers are deep monitored. It turns out the use of "--read-only=True" option kind of blocks / disable full-stack monitoring.

FYI, on the same host, I deep-monitored sucessfully a container Podman / Tomcat / hello world example.

Any experience with this option ?

Regards.

Re: Full-stack monitoring of stand alone Podman container using --read-only=True option

ChadTurner — Thu, 28 Mar 2024 15:30:42 GMT

That makes sense as read only will just be reading metrics (Half Stack and Discovery mode) You will need write permissions for Full Stack since it actively injects the JS into your application header.

Re: Full-stack monitoring of stand alone Podman container using --read-only=True option

gilles_tabary — Thu, 28 Mar 2024 15:39:00 GMT

Hello. Thanks for feedback.

With --read-only=True option I get infra only. Not even "Half Stack". Object is reported as non monitored or having to be restarted.

Also, different (speculative) understanding here : does OneAgent injects on the fly its libraries into the Podman container, so full-stack could work ? Which would require inner-container FS to be writable ?

Re: Full-stack monitoring of stand alone Podman container using --read-only=True option

ChadTurner — Thu, 28 Mar 2024 15:45:30 GMT

Infra is Halfstack 🙂

Re: Full-stack monitoring of stand alone Podman container using --read-only=True option

gilles_tabary — Thu, 28 Mar 2024 15:47:49 GMT

More insight for the discussion. Starting with OneAgent 1.277.165.20231024-150054+ bellow hack lead to full-stack monitoring working fine even
- with ociruntime == runc (== the default)
- with podman run ... --read-only=True ...

# In /etc/containers/containers.conf
...
   "LD_PRELOAD=/lib64/liboneagentproc.so",
...
volumes=[
   “/lib64/liboneagentproc.so: /lib64/liboneagentproc.so:ro”,
   "/opt/dynatrace/oneagent/agent:/opt/dynatrace/oneagent/agent:ro",
...

Re: Full-stack monitoring of stand alone Podman container using --read-only=True option

gilles_tabary — Thu, 28 Mar 2024 15:49:00 GMT

Thanks. Did not know this one.

Re: Full-stack monitoring of stand alone Podman container using --read-only=True option

Stephen1_Lee — Mon, 24 Feb 2025 20:30:49 GMT

We tried adding the lines above to a containers.conf.

But the

"LD_PRELOAD=/lib64/liboneagentproc.so", causes the following error

ERRO[0000] reading system config "/etc/containers/containers.conf": decode configuration /etc/containers/containers.conf: toml: line 303 (last key "containers"): expected '.' or '=', but got '\n' instead

Any idea if there's another way to use LD_PRELOAD or is the syntax correct? Thank you