iovisor / iovisor/bcc

opensnoop -F resolves full paths outside container mount namespace when using relative paths

Open
#5,296 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

**Description:**

When using `bcc`'s `opensnoop` with the `-F` (full path) option in a containerized environment, I observed an unexpected behavior regarding relative file paths accessed within the container. Specifically, when a process inside a container opens a file using a *relative path* in a *mounted volume*, `opensnoop -F` resolves the full path **using the host's mount namespace**, not the container's.

**Steps to Reproduce:**

1. Start a container with a volume mounted, e.g., `-v /host/data:/container/data`.
2. Inside the container, run a process that accesses a file using a relative path, such as:
```bash
cd /container/data
cat file.txt
```
3. On the host, run:
```bash
sudo opensnoop -F
```

**Expected Behavior:**

The full path should resolve based on the container's mount namespace — for example:
```
/container/data/file.txt
```

**Actual Behavior:**

`opensnoop -F` reports the full path as seen from the *host* perspective — for example:
```
/host/data/file.txt
```

This can be misleading when tracing file activity scoped to containers, as it breaks the container's isolation abstraction and complicates debugging or monitoring within container contexts.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.