Repository navigation
fix(processtree): retain cached host process ancestry - #1027
Conversation
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to Host process alert enrichment now keeps ancestry for short-lived processes that have already exited. The change is narrowly scoped and has regression tests, so no merge-blocking risk remains. Pre-merge checks |
  |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 3 files. | Write docstrings for the functions missing them to satisfy the coverage threshold. |
✅ Passed checks (4 passed)
-
Check name Status Explanation Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the main change: preserving cached host process ancestry for process-tree enrichment.
- Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
-
📝 Generate docstrings 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
There was a problem hiding this comment.
🟡 Changes recommended
Default Kubernetes-mode host reparenting prevents the new PID 1 ancestry path from succeeding.
1 open finding
What changed in this PR
Updates host process-tree ancestry to include PID 1 and retain exited-process metadata.
Changes:
- Uses host init as the ancestry root.
- Includes root nodes with PPID 0 when building branches.
- Adds host ancestry and exit-retention regression tests.
| File | Description |
|---|---|
pkg/processtree/container/container_processtree.go |
Adds host-specific root handling. |
pkg/processtree/container/container_processtree_test.go |
Tests host branches and missing ancestry. |
pkg/processtree/process_tree_manager_test.go |
Tests exited host-process enrichment. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| if utils.IsHost(containerID) { | ||
| rootPID, rootKind = 1, "host init" | ||
| shimPID = 0 |
There was a problem hiding this comment.
The KubernetesMode=true behavior described here is accurate, but it is pre-existing and outside this fix’s scope. This PR fixes standalone host-agent mode (KubernetesMode=false), which is the configuration used by the host-agent deployment example and host-agent integration suite; the new manager regression exercises that mode. In Kubernetes mode, handleProcfsEvent deliberately refuses to create host nodes (including PID 1), and handleExecEvent retains its existing reparenting policy. Those paths were not changed by this PR. Missing cached ancestry still returns an error so the caller can use its existing procfs fallback. Seeding PID 1 and retaining complete host ancestry in Kubernetes mode would change that caching/reparenting policy and warrants a separate change. I clarified the standalone-mode scope in the PR description; no code change is needed for this finding.
Performance Benchmark ResultsNode-Agent Resource Usage
Dedup EffectivenessNo data available. |
Overview
Short-lived processes observed by the standalone host agent (
KubernetesMode: false), such as systemd generators, systemctl and ps, can reach alert enrichment after exiting. Although the process tree records their executable path and arguments at exec,GetPidBranch("host", ...)fails because container registration identifies PID 1's parent (PID 0) as its shim. PID 0 has no process-tree node, so callers fall back to procfs after the executable and arguments are already unavailable.Resolve host ancestry against PID 1 and return a cached branch including init and the triggering process. Container branches continue to exclude their shim. Missing roots, targets or parents still return errors, preserving existing caller fallbacks to procfs.
This fixes standalone host-agent mode. Kubernetes mode deliberately skips creating host nodes from procfs and can reparent host exec nodes to the registered shim; that existing policy and the caller's procfs fallback remain unchanged. Retaining complete host ancestry in Kubernetes mode would require a separate change to the process creator's caching/reparenting policy.
Regression tests cover PID 1, direct and nested host children, missing/outside ancestry, branch copy isolation, and exec-to-exit enrichment with a PID that cannot exist in procfs. The host regression fails with
shim process 0 not found in process treebefore the fix.Validation
go test -mod=readonly ./pkg/processtree/... -count=1go test -mod=readonly -race -tags stacktrace -p 1 ./pkg/processtree/... -count=1go vet -mod=readonly ./pkg/processtree/...golangci-lint run --new-from-rev=HEAD ./pkg/processtree/...(run before committing): no new issues. Full package lint reports seven existing findings in unchanged code.make binary BINARY_NAME=/tmp/node-agent-host-process-treeThe private host agent must consume a release containing this upstream fix for deployment.