Sysdig on Alpine Linux

Łukasz Wróblewski

unread,

Jan 14, 2017, 9:54:19 AM1/14/17

to sysdig

Hi,

Is it possible to run Sysdig on Alpine?

Without the use of containers.

Available distributions have a large disk overhead.

Jorge Salamero Sanz

unread,

Jan 15, 2017, 4:41:02 PM1/15/17

to sysdig

Hi Łukasz,

have you tried something like this?

https://medium.com/@etown/sysdig-running-on-the-new-native-docker-apps-cbc274f80cc0#.wt128pjwp

--
www.sysdig.org
https://github.com/draios/sysdig
www.draios.com
---
You received this message because you are subscribed to the Google Groups "sysdig" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sysdig+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Jorge Salamero - @bencerillo

Łukasz Wróblewski

unread,

Jan 17, 2017, 5:45:39 AM1/17/17

to sysdig

Perhaps I did not make myself clear.

As a basic system I use CoreOS

The OS itself takes less than 1GB of disk space.

So now if I want to take advantage of csysdig I have two options:

1. toolbox

# du -sh /var/lib/toolbox/
8.0K	/var/lib/toolbox/

# toolbox --bind=/dev --bind=/var/run/docker.sock
# curl -s https://s3.amazonaws.com/download.draios.com/stable/install-sysdig | bash
# sysdig-probe-loader
...

# du -sh /var/lib/toolbox/
762M	/var/lib/toolbox/

Default toolbox OS is Fedora.

Once built, installed and running csysdig, used size on disk has increased by 762 MB.

2. docker pull sysdig/sysdig

# du -sh /var/lib/docker/
476K	/var/lib/docker/

# docker pull sysdig/sysdig
Using default tag: latest
latest: Pulling from sysdig/sysdig
4ae38a256eb1: Pull complete 
abc77813df7c: Pull complete 
6d5f1594dcbc: Pull complete 
1cdd937d1cc7: Pull complete 
26c98cece305: Pull complete 
2dd52510d66c: Pull complete 
a8d8ac7373d1: Pull complete 
23da7e96272c: Pull complete 
Digest: sha256:f49f0d6d39b73a269705508000e1808f22851277c508f573d0aa32963d361100
Status: Downloaded newer image for sysdig/sysdig:latest

# du -sh /var/lib/docker/
484M	/var/lib/docker/

FROM debian:unstable
484 MB additional dick space is not bad.

Jorge Salamero Sanz mentioned a third option.

# du -sh /var/lib/docker/
476K	/var/lib/docker/

# docker run --rm --privileged etown/install-sysdig-module
Unable to find image 'etown/install-sysdig-module:latest' locally
latest: Pulling from etown/install-sysdig-module
40f9ed72912e: Pull complete 
ebf14abba9c1: Pull complete 
2dcae8988f92: Pull complete 
Digest: sha256:2bbf182a52471c21e7767bea0040e563c2d3a874e4d833a3308ac2060c49bffe
Status: Downloaded newer image for etown/install-sysdig-module:latest
insmod: can't insert '/sysdig/build/driver/sysdig-probe.ko': invalid module format

# du -sh /var/lib/docker/
1.3G	/var/lib/docker/

1.3 GB additional dick space and even does not work.

The best result is 500 MB additional dick space.

Do not you think that's a lot if I want to add just one tool?

I think it is very much.

Especially, if occasionally i will use the toolbox.

You need to add another 500 MB for it.

The issue of the size of the toolbox solved exchange fedora on alpine.

If I could there could install csysdig ...

Or if docker sysdig/sysdig use alpine as base system instead of debian:unstable.