how run ecli in docker

[try-agaaain]

Our image will be automatically built and uploaded to the packages in the repository by CI in a few days. At that time, you can get the ecli image as follows:

docker pull ghcr.io/eunomia-bpf/ecli-`uname -a`:latest # for x86_64 or aarch

Due to security considerations, Docker restricts system calls. To run the docker image, you need to add the options --cap-add CAP_SYS_ADMIN and --privileged as follows:

docker run -it -v `pwd`/:/src/ --cap-add CAP_SYS_ADMIN --privileged ghcr.io/eunomia-bpf/ecli-`uname -a`:latest

In the ecli image, ecli is added to the system path, so you can use the command directly, for example:

ecli package.json

You may encounter the following problem:

libbpf: failed to determine tracepoint 'syscalls/sys_enter_write' perf event ID: No such file or directory
libbpf: prog 'handle_tp': failed to create tracepoint 'syscalls/sys_enter_write' perf event: No such file or directory
libbpf: prog 'handle_tp': failed to auto-attach: -2
failed to attach skeleton
load and attach ebpf program failed

In this case, you need to mount the debugfs file system to /sys/kernel/debug to use ecli to access kernel information. You can achieve this in the container as follows:

mount -t debugfs none /sys/kernel/debug

By the way, if you are using WSL to run containers in a Windows system, you need to make sure your WSL kernel supports BPF. If it doesn't, you can try updating the kernel with wsl --update.