Merge upstream coroot/coroot-node-agent changes

[mayankpande88]

Summary

• Merges 35 upstream commits from coroot/coroot-node-agent into our fork
• Key upstream changes: uretprobe to uprobe segfault fix (elf.go abstraction), async uprobe close, python panic fix, ignore deleted cgroups, systemd D-Bus refactoring, GCP metadata, GPU monitoring flag, journald fallback
• Dependency upgrades: cilium/ebpf v0.20.0, containerd v1.7.29, go-systemd v22.7.0, godbus v5.2.2, golang.org/x/sys v0.40.0

Conflict Resolution

• containers/container.go: Kept nudgebee logparser fork API (DisableSensitiveLogParsing)
• containers/registry.go: Merged upstream deleted cgroup check with our read lock pattern
• ebpftracer/tls.go: Integrated upstream elf.go API (GetSymbol/AttachUprobe/AttachUretprobes) with our S2A symbol support and Go TLS offset discovery
• flags/flags.go: Kept nudgebee-specific flags, added upstream DisableGPUMonitoring and LogPatternsPerContainer
• go.mod: Took higher version of each shared dependency

[gemini-code-assist]

Summary of Changes

Hello @mayankpande88, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request integrates a significant number of upstream changes from the coroot-node-agent repository, focusing on enhancing stability, improving systemd and container runtime integration, and refining eBPF tracing capabilities. It introduces a new ELF parsing utility to make uprobe and uretprobe attachments more reliable across different programming languages and environments. Additionally, it updates several core dependencies and introduces new configuration options for better control over monitoring features.

Highlights

• Upstream Merges: Incorporated 35 upstream commits from coroot/coroot-node-agent, bringing in various fixes and enhancements.
• eBPF Tracing Improvements: Introduced an elf.go abstraction to handle ELF symbol parsing, addressing uretprobe segfaults and enabling more robust uprobe and uretprobe attachments for Go, Node.js, and Python applications. Uprobe closing is now asynchronous.
• Systemd Integration Refactoring: Refactored systemd D-Bus interaction with a new DbusClient for caching and retries, improved systemd service detection, and added a flag to skip well-known systemd system services.
• Container Cgroup Handling: Enhanced cgroup parsing to include kube.slice and azure.slice, and added logic to ignore deleted cgroups, preventing unnecessary processing.
• GCP Metadata Fetching: Updated GCP metadata retrieval to use a direct net/http client with network namespace execution, removing a dependency and improving reliability.
• Dependency Upgrades: Updated key dependencies including cilium/ebpf to v0.20.0, containerd to v1.7.29, go-systemd to v22.7.0, godbus to v5.2.2, and golang.org/x/sys to v0.40.0.
• New Configuration Flags: Added new flags for DisableGPUMonitoring, SkipSystemdSystemServices, and LogPatternsPerContainer to provide more granular control over agent behavior.
• Python Panic Fix: Addressed a potential panic in Python instrumentation by adding a length check before processing command fields.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

• Dockerfile
  • Switched the base image from golang:1.24.7-trixie to debian:bullseye and manually installed Go 1.24.9, citing compatibility issues with newer glibc versions in the official Golang image.
• cgroup/cgroup.go
  • Expanded systemSliceIdRegexp to include kube and azure slices for broader systemd service detection.
  • Added systemd as a prefix to identify standalone processes within cgroups.
  • Introduced a check for .scope suffixes within systemd slices to classify them as standalone processes.
• cgroup/cgroup_test.go
  • Added new test cases to verify the correct identification of kube.slice and azure.slice as systemd services.
  • Included tests for various .scope cgroup paths to ensure they are correctly identified as standalone processes.
• containers/container.go
  • Refactored systemdTriggeredBy field in ContainerMetadata to a more comprehensive SystemdProperties struct.
  • Updated the Collect method to emit systemd_type along with systemd_triggered_by for container info metrics.
  • Modified JournaldSubscribe and JournaldUnsubscribe calls to pass the systemd unit name instead of the cgroup object.
• containers/containerd.go
  • Updated json.Unmarshal calls to use GetValue() method on c.Spec and data objects, aligning with newer containerd API changes.
• containers/journald.go
  • Removed the import of github.com/coroot/coroot-node-agent/cgroup as it's no longer directly used.
  • Changed JournaldSubscribe and JournaldUnsubscribe functions to accept a unit string instead of a *cgroup.Cgroup object.
• containers/metrics.go
  • Added systemd_type as a new label to the container_info metric, providing more detailed systemd context.
• containers/process.go
  • Added a check for the length of cmdFields before calling bytes.Fields(cmd)[0] to prevent a potential panic in instrumentPython.
  • Implemented asynchronous closing of uprobes to avoid blocking the main thread during process shutdown.
• containers/registry.go
  • Removed a klog.Infoln message for TCP connection errors from unknown containers to reduce log verbosity.
  • Added a check to immediately return nil if a cgroup ID ends with (deleted), effectively ignoring deleted cgroups.
  • Introduced logic to skip well-known systemd system services based on the SkipSystemdSystemServices flag.
• containers/systemd.go
  • Refactored systemd D-Bus interaction into a new DbusClient struct, including connection management, caching, and retry logic.
  • Introduced a SystemdProperties struct to encapsulate systemd unit, triggered-by, and type information.
  • Added an IsSystemService method to SystemdProperties for identifying common system services.
  • Removed the direct klog import, relying on the klog/v2 package for logging.
• ebpftracer/elf.go
  • Added a new file elf.go which provides an abstraction for parsing ELF files, finding symbols, and calculating return offsets for uprobe and uretprobe attachments.
• ebpftracer/nodejs.go
  • Refactored AttachNodejsProbes to utilize the new elf.go abstraction for robust symbol lookup and uprobe/uretprobe attachment for Node.js applications.
• ebpftracer/python.go
  • Updated the muslRegexp to specifically match ld-musl for more accurate library detection.
  • Refactored AttachPythonThreadLockProbes to use the new elf.go abstraction for symbol lookup and uprobe/uretprobe attachment for Python applications.
• ebpftracer/tls.go
  • Removed direct imports of errors, io, arm64asm, and x86asm as their functionality is now encapsulated within elf.go.
  • Refactored AttachOpenSslUprobes and AttachGoTlsUprobes to leverage the elf.go abstraction for symbol discovery and uprobe/uretprobe attachment.
  • Removed the getReturnOffsets function, as its logic is now part of the elf.go file.
• flags/flags.go
  • Added a new command-line flag DisableGPUMonitoring to control GPU monitoring.
  • Introduced SkipSystemdSystemServices flag to allow skipping monitoring of common systemd services.
  • Added LogPatternsPerContainer flag to configure the maximum number of unique log patterns stored per container.
• go.mod
  • Upgraded github.com/cilium/ebpf from v0.19.0 to v0.20.0.
  • Upgraded github.com/containerd/cgroups from v1.0.4 to v1.1.0.
  • Upgraded github.com/containerd/containerd from v1.6.38 to v1.7.29.
  • Upgraded github.com/coreos/go-systemd/v22 from v22.5.0 to v22.7.0.
  • Upgraded github.com/godbus/dbus/v5 from v5.1.0 to v5.2.2.
  • Upgraded github.com/opencontainers/runtime-spec from v1.0.3 to v1.1.0.
  • Upgraded golang.org/x/sys from v0.37.0 to v0.40.0.
  • Upgraded github.com/Microsoft/hcsshim from v0.9.12 to v0.11.7.
  • Upgraded golang.org/x/tools from v0.37.0 to v0.38.0.
  • Removed cloud.google.com/go/compute/metadata dependency.
• gpu/gpu.go
  • Imported the flags package to access new configuration options.
  • Added a check for flags.DisableGPUMonitoring in NewCollector to conditionally initialize GPU monitoring.
  • Added a nil check for c.iface in the Close method to prevent panics if NVML was not initialized.
• install.sh
  • Updated the ENV_VARS regex to include DISABLE_GPU_MONITORING, ensuring it's recognized during installation.
• logs/journald_reader.go
  • Defined journaldPollTimeout constant for consistent polling intervals.
  • Added more detailed error logging during journal initialization to provide better debugging information.
  • Modified the follow loop's Wait call to include a time.Sleep fallback if inotify limits prevent immediate journal updates.
  • Changed the subscriber key from SD_JOURNAL_FIELD_SYSTEMD_CGROUP to SD_JOURNAL_FIELD_SYSTEMD_UNIT for journald subscriptions, aligning with systemd unit-based logging.
• node/metadata/gcp.go
  • Rewrote GCP metadata fetching logic to use a custom http.Client that executes requests within the host's network namespace, removing the cloud.google.com/go/compute/metadata dependency.
  • Updated getGcpMetadataVariable to perform direct HTTP requests to the metadata service, including error handling for network issues and non-200 responses.
• node/net.go
  • Modified netDeviceFilterRe regex to include br (bridge) and vmbr (virtual bridge) prefixes, and made the enx suffix more flexible to match various network device names.
  • Converted the device name to lowercase before applying the netDeviceFilterRe regex for case-insensitive matching.
• node/net_test.go
  • Updated TestNetDeviceFilter to reflect the expanded netDeviceFilterRe regex, including new test cases for enX0, br0, and vmbr0.
• proc/fd.go
  • Corrected error handling in ReadFds to only log warnings for os.Readlink errors if they are not os.IsNotExist, preventing excessive logging for transient file descriptor states.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request incorporates significant upstream changes, including crucial bug fixes, major refactorings, and dependency upgrades, greatly enhancing the agent's stability and functionality. Key improvements include a fix for a segfault when attaching uretprobes through a new ELF file abstraction, asynchronous closing of uprobes, a fix for a potential panic in Python instrumentation, and refactored systemd services and GCP metadata handling. However, a critical logic error was identified in the newly added ebpftracer/elf.go file. The uprobe attachment logic incorrectly uses the cilium/ebpf API, mixing symbol names with absolute file offsets and using a hardcoded symbol name, which breaks the agent's ability to monitor TLS traffic and Node.js event loops essential for security observability. Additionally, one minor issue was found during the review.