paulinhu/bpftrace repository overview

⁠bpftrace

Lightweight docker image to run bpftrace commands. It contains the kernel dependencies for x86/x64 and is based on linux kernel 5.0.x.

To run a command use the command below:

docker run --rm -t -v /sys/kernel/debug:/sys/kernel/debug:ro \
    --cap-add=SYS_ADMIN \
    --security-opt no-new-privileges \
    paulinhu/bpftrace:alpine \
    sh -c "/init.sh && bpftrace -e 'kprobe:do_sys_open { printf(\"%s: %s\n\", comm, str(arg1)) } interval:s:2 { exit(); }'"

Note that the /init.sh command will automatically create a symlink based on the run-time kernel. Without that, bpftrace will only execute when the host machine has the same kernel release as it was used to build the image.

If you require to support earlier/older kernel versions, use the Dockerfile and fiddle with the arguments KERNEL_VERSION and KERNEL_RELEASE and generate your own image, as shown on Makefile⁠.

For more information about this image, check out this post⁠