Add container image id filtercheck. (#661)

Add support for displaying container image ids via the filtercheck container.image.id. Only supported for docker containers right now.
draios · Sep 22, 2016 · 8627ade · 8627ade
1 parent 42b8081
commit 8627ade
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 1 deletion.
diff --git a/userspace/libsinsp/filterchecks.cpp b/userspace/libsinsp/filterchecks.cpp
@@ -5322,7 +5322,8 @@ const filtercheck_field_info sinsp_filter_check_container_fields[] =
 {
 	{PT_CHARBUF, EPF_NONE, PF_NA, "container.id", "the container id."},
 	{PT_CHARBUF, EPF_NONE, PF_NA, "container.name", "the container name."},
-	{PT_CHARBUF, EPF_NONE, PF_NA, "container.image", "the container image."},
+	{PT_CHARBUF, EPF_NONE, PF_NA, "container.image", "the container image name (e.g. sysdig/sysdig:latest for docker, )."},
+	{PT_CHARBUF, EPF_NONE, PF_NA, "container.image.id", "the container image id (e.g. 6f7e2741b66b)."},
 	{PT_CHARBUF, EPF_NONE, PF_NA, "container.type", "the container type, eg: docker or rkt"},
 	{PT_BOOL, EPF_NONE, PF_NA, "container.privileged", "true for containers running as privileged, false otherwise"},
 	{PT_CHARBUF, EPF_NONE, PF_NA, "container.mounts", "A space-separated list of mount information. Each item in the list has the format <source>:<dest>:<mode>:<rdrw>:<propagation>"},
@@ -5504,6 +5505,30 @@ uint8_t* sinsp_filter_check_container::extract(sinsp_evt *evt, OUT uint32_t* len
 			m_tstr = container_info.m_image;
 		}
 
+		*len = m_tstr.size();
+		return (uint8_t*)m_tstr.c_str();
+	case TYPE_CONTAINER_IMAGE_ID:
+		if(tinfo->m_container_id.empty())
+		{
+			return NULL;
+		}
+		else
+		{
+			sinsp_container_info container_info;
+			bool found = m_inspector->m_container_manager.get_container(tinfo->m_container_id, &container_info);
+			if(!found)
+			{
+				return NULL;
+			}
+
+			if(container_info.m_imageid.empty())
+			{
+				return NULL;
+			}
+
+			m_tstr = container_info.m_imageid;
+		}
+
 		*len = m_tstr.size();
 		return (uint8_t*)m_tstr.c_str();
 	case TYPE_CONTAINER_TYPE:

diff --git a/userspace/libsinsp/filterchecks.h b/userspace/libsinsp/filterchecks.h
@@ -767,6 +767,7 @@ class sinsp_filter_check_container : public sinsp_filter_check
 		TYPE_CONTAINER_ID = 0,
 		TYPE_CONTAINER_NAME,
 		TYPE_CONTAINER_IMAGE,
+		TYPE_CONTAINER_IMAGE_ID,
 		TYPE_CONTAINER_TYPE,
 		TYPE_CONTAINER_PRIVILEGED,
 		TYPE_CONTAINER_MOUNTS,