Skip to content

fix(plugins/container): use an unique ctx for fetcher. #758

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
poiana merged 1 commit into from
May 6, 2025
Merged

fix(plugins/container): use an unique ctx for fetcher. #758

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions plugins/container/go-worker/pkg/container/fetcher.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,22 +22,28 @@ func GetFetcherChan() chan<- string {

type fetcher struct {
getters []getter
ctx context.Context
}

// NewFetcherEngine returns a fetcher engine.
// The fetcher engine is responsible to allow us to get() single container
// trying all container engines enabled.
func NewFetcherEngine(ctx context.Context, containerEngines []Engine) Engine {
func NewFetcherEngine(_ context.Context, containerEngines []Engine) Engine {
f := fetcher{
getters: make([]getter, len(containerEngines)),
// Since podman relies upon context to store
// connection-related info,
// we need a unique context for fetcher
// to avoid tampering with real podman engine context.
ctx: context.Background(),
}
for i, engine := range containerEngines {
copyEngine, ok := engine.(copier)
if !ok {
// We need all engines to implement the copier interface to be copied by fetcher.
panic("not a copier")
}
e, _ := copyEngine.copy(ctx)
e, _ := copyEngine.copy(f.ctx)
Copy link
Contributor Author

@FedeDP FedeDP May 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In this call, podman will store into ctx its key/value for the connection, see https://github.com/falcosecurity/plugins/blob/main/plugins/container/go-worker/pkg/container/podman.go#L32 (and NewConnection behavior: https://github.com/containers/podman/blob/main/pkg/bindings/connection.go#L139).

From NewConnection doc:

// NewConnectionWithIdentity takes a URI as a string and returns a context with the
// Connection embedded as a value. This context needs to be passed to each
// endpoint to work correctly.

if e != nil {
// No type check since Engine interface extends getter.
f.getters[i] = e.(getter)
Expand Down Expand Up @@ -75,7 +81,7 @@ func (f *fetcher) Listen(ctx context.Context, wg *sync.WaitGroup) (<-chan event.
return
case containerId := <-fetcherChan:
for _, e := range f.getters {
evt, _ := e.get(ctx, containerId)
evt, _ := e.get(f.ctx, containerId)
if evt != nil {
outCh <- *evt
break
Expand Down
Loading