microsoft / microsoft/ebpf-for-windows

The helper bpf_get_current_pid_tgid returns wrong PID for process in container

Open
#3,293 2 comments 0 reactions 0 assignees View on GitHub
blocked bug P2 triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

Steps:
1) Run https://github.com/Alan-Jowett/connection_tracker/
2) Run curl 1.1.1.1 from within a Windows isolated container

Expected result:
Shows the PID of the process doing the curl.

Actual result:
PID shows up as 4 (aka system).

Contributor guide

Open the contributing guide

Research direction

Start by running the linked connection_tracker reproduction and issuing curl from a Windows isolated container. Trace where bpf_get_current_pid_tgid is handled for that process and compare the reported PID with the curl process. Done means the helper reports the calling process PID instead of 4 in this scenario.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.