interceptors

Documentation

Index

• type Chain
  • func NewChain(psnap ps.Snapshotter, hsnap handle.Snapshotter, rundownFn func() error, ...) Chain
• type InterceptorType
  • func (typ InterceptorType) String() string
• type KstreamInterceptor

Types

type Chain

type Chain interface {
	// Dispatch pushes a kernel event into interceptor chain. Interceptors are applied sequentially, so we have to make
	// sure that any interceptor providing additional context to the next interceptor is defined first in the chain. If
	// one interceptor fails, the next interceptor in chain is invoked.
	Dispatch(kevt *kevent.Kevent) (*kevent.Kevent, error)
	// Close closes the interceptor chain and frees all allocated resources.
	Close() error
}

Chain defines the method that all chan interceptors have to satisfy.

func NewChain

func NewChain(
	psnap ps.Snapshotter,
	hsnap handle.Snapshotter,
	rundownFn func() error,
	config *config.Config,
	deferredKevtsCh chan *kevent.Kevent,
) Chain

NewChain constructs the interceptor chain. It arranges all the interceptors according to enabled kernel event categories.

type InterceptorType

type InterceptorType uint8

InterceptorType is an alias for the interceptor type

const (
	// Ps represents the process interceptor.
	Ps InterceptorType = iota
	// Fs represents the file system interceptor.
	Fs
	// Registry represents the registry interceptor.
	Registry
	// Image represents the image interceptor.
	Image
	// Net represents the network interceptor.
	Net
	// Handle represents the handle interceptor.
	Handle
)

func (InterceptorType) String

func (typ InterceptorType) String() string

String returns a human-friendly interceptor name.

type KstreamInterceptor

type KstreamInterceptor interface {
	// Intercept receives an existing kernel event possibly mutating its state. The event is filtered out if
	// this method returns an error. If it returns true, the next interceptor in the chain is evaluated.
	Intercept(kevt *kevent.Kevent) (*kevent.Kevent, bool, error)

	// Name returns a human-readable name of this interceptor.
	Name() InterceptorType

	// Close closes the interceptor and disposes allocated resources.
	Close()
}

KstreamInterceptor is the minimal interface that each kernel stream interceptor has to satisfy. Kernel stream interceptor has the ability to augment kernel event with additional parameters. It is also capable of building a state machine from the flow of kernel events going through it. The interceptor can also decide to drop the inbound kernel event by returning an error via its `Intercept` method.