eBPFをDocker使えるようにする

2023/03/25

code:memo

$ execsnoop-bpfcc -UTx

bash: execsnoop-bpfcc: command not found

$ execsnoop-bpfcc -UTx

sh: 1: modprobe: not found

Unable to find kernel headers. Try rebuilding kernel with CONFIG_IKHEADERS=m (module) or installing the kernel development package for your running kernel version.

chdir(/lib/modules/5.15.49-linuxkit/build): No such file or directory

Traceback (most recent call last):

File "/usr/sbin/execsnoop-bpfcc", line 227, in <module>

b = BPF(text=bpf_text)

File "/usr/lib/python3/dist-packages/bcc/__init__.py", line 364, in __init__

raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))

Exception: Failed to compile BPF module <text>

modprobeがないので入れる。なんか調べていくとkmodを入れるとよかった。

$ apt-get install kmod

以下を入れてみる

bcc-tools

libbcc-examples

linux-headers-$(uname -r)

code:memo

No package matching 'linux-headers-5.15.49-linuxkit' is available

code:memo

root@02e84793ebb7 ebpf

$ uname -r

5.15.49-linuxkit

root@02e84793ebb7 ebpf

$ depmod

depmod: ERROR: could not open directory /lib/modules/5.15.49-linuxkit: No such file or directory

depmod: FATAL: could not search modules: No such file or directory

LinuxKitが必要らしい。

2023/04/01

Unable to install Linux headers in GitHub action · community · Discussion #28607

Unable to locate package linux-headers-5.15.49-linuxkit · Issue #4387 · iovisor/bcc

Tutorial Commands Fail to Launch In Quick Start Container on macOS · Issue #3276 · iovisor/bcc

singe/ebpf-docker-for-mac: How to run eBPF on Docker for mac

確認用

Q. eBPFを使えるようにする

参考