Security News
Opengrep Emerges as Open Source Alternative Amid Semgrep Licensing Controversy
Opengrep forks Semgrep to preserve open source SAST in response to controversial licensing changes.
github.com/open-telemetry/opentelemetry-collector-contrib/extension/observer/dockerobserver
Status | |
---|---|
Stability | beta |
Distributions | contrib |
Issues | |
Code Owners | @MovieStoreGuy |
The Docker observer extension is a Receiver Creator-compatible "watch observer" that will detect and report
container endpoints discovered through the Docker API. Only containers that are in the state of Running
and not Paused
will emit endpoints.
This observer watches the Docker engine's stream of events to dynamically create, update, and remove endpoints as events are processed.
Requires Docker API Version 1.24+.
The collector will need permissions to access the Docker Engine API, specifically it will need
read access to the Docker socket (default unix:///var/run/docker.sock
on non-Windows and npipe:////./pipe/docker_engine
on Windows).
extensions:
docker_observer:
# url of the docker socket, defaults to unix:///var/run/docker.sock on non-Windows and npipe:////./pipe/docker_engine on Windows
endpoint: my/path/to/docker.sock
# list of container image names to exclude
excluded_images: ['redis', 'another_image_name']
# client API version, default to 1.24
api_version: "1.25"
# max amount of time to wait for a response from Docker API , default to 5s
timeout: 15s
receivers:
receiver_creator:
watch_observers: [docker_observer]
receivers:
nginx:
rule: type == "container" and name matches "nginx" and port == 80
config:
endpoint: '`endpoint`/status'
collection_interval: 10s
endpoint
The URL of the docker server.
default: unix:///var/run/docker.sock
on non-Windows and npipe:////./pipe/docker_engine
on Windows
timeout
The maximum amount of time to wait for docker API responses.
default: 5s
api_version
The client API version. Make sure you input it as a string instead of a float (e.g. "1.4"
instead of 1.4
).
default: "1.24"
excluded_images
A list of filters whose matching images are to be excluded. Supports literals, globs, and regex.
default: []
use_hostname_if_present
If true, the Config.Hostname
field (if present) of the docker
container will be used as the discovered host that is used to configure
receivers. If false or if no hostname is configured, the field
NetworkSettings.IPAddress
is used instead. These settings can be found
in the output of the Docker API's Container Inspect json.
default: false
use_host_bindings
If true, the observer will configure receivers for matching container endpoints using the host bound ip and port. This is useful if containers exist that are not accessible to an instance of the collector running outside of the docker network stack.
default: false
ignore_non_host_bindings
If true, the observer will ignore discovered container endpoints that are not bound to host ports. This is useful if containers exist that are not accessible to an instance of the collector running outside of the docker network stack.
default: false
cache_sync_interval
The time to wait before resyncing the list of containers the observer maintains
through the docker event listener example: cache_sync_interval: "20m"
default: 60m
The following endpoint variables are exposed to the receiver creator to be used in discovery rules:
Variable | Type | Description |
---|---|---|
name | string | Primary name of the container |
image | string | Name of the container image |
port | uint16 | Exposed port of the container |
alternate_port | uint16 | Exposed port accessed through redirection, such as a mapped port |
command | string | The command used to invoke the process of the container |
container_id | string | ID of the container |
host | string | Hostname or IP of the underlying host the container is running on |
transport | string | Transport protocol used by the endpoint (TCP or UDP) |
labels | map[string]string | User-specified metadata labels on the container |
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Opengrep forks Semgrep to preserve open source SAST in response to controversial licensing changes.
Security News
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
Security News
cURL and Go security teams are publicly rejecting CVSS as flawed for assessing vulnerabilities and are calling for more accurate, context-aware approaches.