opensnoop -F resolves full paths outside container mount namespace when using relative paths
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
**Description:**
When using `bcc`'s `opensnoop` with the `-F` (full path) option in a containerized environment, I observed an unexpected behavior regarding relative file paths accessed within the container. Specifically, when a process inside a container opens a file using a *relative path* in a *mounted volume*, `opensnoop -F` resolves the full path **using the host's mount namespace**, not the container's.
**Steps to Reproduce:**
1. Start a container with a volume mounted, e.g., `-v /host/data:/container/data`.
2. Inside the container, run a process that accesses a file using a relative path, such as:
```bash
cd /container/data
cat file.txt
```
3. On the host, run:
```bash
sudo opensnoop -F
```
**Expected Behavior:**
The full path should resolve based on the container's mount namespace — for example:
```
/container/data/file.txt
```
**Actual Behavior:**
`opensnoop -F` reports the full path as seen from the *host* perspective — for example:
```
/host/data/file.txt
```
This can be misleading when tracing file activity scoped to containers, as it breaks the container's isolation abstraction and complicates debugging or monitoring within container contexts.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.