Monitoring filesystems with fanotify inside containers
summary
Work makes fanotify filesystem watch features available inside containers using two strategies: allow filesystems mounted or idmapped into a userns so the userns admin can use fanotify, or let container users subscribe to a host-side service that streams container-scoped events. The filesystem-wide watch added in kernel 5.1 and HSM additions in kernel 6.12 deliver file-handle events instead of paths, and recent kernel + systemd plumbing enable resolving handles to paths and policy-controlled access for rootless containers even at scales of millions of files.
AI-written summary · about
chapters (8)
- 0:00Containers and kernel plumbing
- 1:52FS notify and fanotify basics
- 3:20Filesystem change detection at scale
- 5:06Extending fanotify for monitoring
- 7:15Rootless containers and watch limits
- 9:41Watching large filesystems
- 11:28Policy-based fanotify delegation
- 12:33Summary and applications
related talks
29mFilesystem mounts in user namespaces
42mSecuring Filesystem Images for Unprivileged Containers
50mImproving Container Security with System Call Interception
45mMaking Containers Safer
46mCurrent State of Kernel Audit and Linux Namespaces, Looking Ahead to Containers
42mWhat's New in the User Namespace
45mSecuring Container Runtimes -- How Hard Can It Be?
44mRootless containers