ic-builder
2d2aa3ef38
ci / audit (push) Successful in 33s
- PVE 9 dropped 'pct set --raw.lxc': lxc.apparmor.profile goes straight into /etc/pve/lxc/<vmid>.conf and PVE::LXC honors it over the generated profile (verified: /proc/self/attr/current = unconfined) - pct skips virtual-fs bind sources (mp /proc,/sys/kernel/* landed empty): keep cgroupfs + /var/log binds, wrapper mounts tracefs/debugfs at start - bpftrace PROVEN against host kernel (2689 tracepoints, live syscall counts showing host pvestatd/vgs); bcc-tools -> bpfcc-tools (bookworm) - smartctl on SAT devices needs -d sat (recipes updated) Redmine: https://projects.knownelement.com/issues/826
35 lines
1.5 KiB
Bash
Executable File
35 lines
1.5 KiB
Bash
Executable File
#!/bin/sh
|
|
# knelperf-toolbox — front door to the on-demand perf toolbox LXC on this node.
|
|
# usage: knelperf-toolbox run '<cmd>' (starts the LXC if stopped, runs, leaves it up)
|
|
# knelperf-toolbox shell (interactive)
|
|
# knelperf-toolbox start|stop|status
|
|
# The LXC (vmid 950) is STOPPED at rest — zero footprint; stop it when done.
|
|
# Docs: https://community.turnsys.com/t/328
|
|
VMID=${KNELPERF_TOOLBOX_VMID:-950}
|
|
|
|
ensure_running() {
|
|
if ! pct status "$VMID" 2>/dev/null | grep -q running; then
|
|
pct start "$VMID"
|
|
i=0
|
|
until pct exec "$VMID" -- true 2>/dev/null; do
|
|
i=$((i + 1)); [ $i -gt 45 ] && { echo "boot timeout" >&2; return 1; }
|
|
sleep 2
|
|
done
|
|
fi
|
|
# host-kernel analysis mounts — pct skips virtual-fs bind sources, so
|
|
# tracefs/debugfs are mounted at runtime (container is privileged +
|
|
# apparmor unconfined precisely for this).
|
|
pct exec "$VMID" -- sh -c '
|
|
mountpoint -q /sys/kernel/tracing || mount -t tracefs none /sys/kernel/tracing 2>/dev/null
|
|
mountpoint -q /sys/kernel/debug || mount -t debugfs none /sys/kernel/debug 2>/dev/null'
|
|
}
|
|
|
|
case "${1:-help}" in
|
|
run) shift; ensure_running && pct exec "$VMID" -- sh -c "$*" ;;
|
|
shell) ensure_running && pct enter "$VMID" ;;
|
|
start) ensure_running ;;
|
|
stop) pct shutdown "$VMID" --timeout 60 2>/dev/null || pct stop "$VMID" ;;
|
|
status) pct status "$VMID" 2>/dev/null || echo "vmid $VMID not present" ;;
|
|
*) sed -n '2,6p' "$0" | sed 's/^# \?//' ;;
|
|
esac
|