Problems attaching to an already-running (`No symbol "__pptop_start_injection" in current context`)

[sgnn7]

Setup:

• Docker for Mac
• Target: Running container with datadog-agent (Python 3.8 embedded process):

docker run --rm -d \
           --name dd-agent \
           --net host \
           -e DD_API_KEY="fake" \
           -v /proc/:/host/proc/:ro \
           -v /sys/fs/cgroup/:/host/sys/fs/cgroup:ro \
           -v /var/run/docker.sock:/var/run/docker.sock:ro \
           -v /opt/datadog-agent/run:/opt/datadog-agent/run:rw \
           datadog/agent

Attachment container (some flags aren't needed - was using this for debugging):

$ docker run --rm -it \
           --name="devenv" \
           --pid="container:dd-agent" \
           --cap-add="SYS_PTRACE" \
           --cap-add="SYS_ADMIN" \
           --privileged \
           --security-opt="seccomp=unconfined" \
           --security-opt="apparmor=unconfined" \
           ubuntu:21.10

Running:

$ apt update && apt install -y gdb python3-pip
$ pip3 install pptop

$ agent_pid=$(ps -ef | grep 'agent run$' | awk '{print $2}')

$ 
pptop $agent_pid
b'No symbol "__pptop_start_injection" in current context.\n'

[divi255]

are you trying to run pptop inside docker or on the main host?

[sgnn7]

@divi255 Yes. The permissions/capabilities on the attaching container should be enough to make them see each other but I didn't investigate the source of this particular error much though.

[divi255]

pptop doesn't work on osx and I have no way to port the c-part as have no osx systems around

https://github.com/alttch/pptop/blob/master/src/__pptop_injector.c - if you port this, the community will be happy

related issue: https://github.com/alttch/pptop/issues/2