Full-stack monitoring of stand alone Podman container using --read-only=True option

[gilles_tabary]

Hello.

Did any one successfully full-stack monitored stand alone Podman (no platform) containers running with --read-only=True option ?

/usr/bin/podman run ...  --read-only=True ... 

I have a Linux RHEL host, OneAgent'ed in full-stack mode with Podman container monitoring enabled, running many containers, Ociruntime == crun and Podman version officially supported. But none of my containers are deep monitored. It turns out the use of "--read-only=True" option kind of blocks / disable full-stack monitoring.

FYI, on the same host, I deep-monitored sucessfully a container Podman / Tomcat / hello world example.

Any experience with this option ?

Regards.

[ChadTurner · Accepted solution]

That makes sense as read only will just be reading metrics (Half Stack and Discovery mode) You will need write permissions for Full Stack since it actively injects the JS into your application header. 

[gilles_tabary]

Hello. Thanks for feedback.

With --read-only=True option I get infra only. Not even "Half Stack". Object is reported as non monitored or having to be restarted.

Also, different (speculative) understanding here : does OneAgent injects on the fly its libraries into the Podman container, so full-stack could work ? Which would require inner-container FS to be writable ?

[ChadTurner · Accepted solution]

Infra is Halfstack 🙂 

[gilles_tabary]

Thanks. Did not know this one.

[gilles_tabary]

More insight for the discussion. Starting with OneAgent 1.277.165.20231024-150054+ bellow hack lead to full-stack monitoring working fine even
- with ociruntime == runc (== the default) 
- with podman run ... --read-only=True ...

# In /etc/containers/containers.conf
...
   "LD_PRELOAD=/lib64/liboneagentproc.so",
...
volumes=[
   “/lib64/liboneagentproc.so: /lib64/liboneagentproc.so:ro”,
   "/opt/dynatrace/oneagent/agent:/opt/dynatrace/oneagent/agent:ro",
...