Filter on docker labels?

[ejholmes]

At the moment sysdig -l shows a couple filters that can be used to filter on labels from kubernetes, mesos and marathon:

----------------------
Field Class: k8s

k8s.pod.labels  Kubernetes pod comma-separated key/value labels. E.g. 'foo1:bar
                1,foo2:bar2'.

----------------------
Field Class: mesos

mesos.task.labels
                Mesos task comma-separated key/value labels. E.g. 'foo1:bar1,fo
                o2:bar2'.
marathon.app.labels
                Marathon app comma-separated key/value labels. E.g. 'foo1:bar1,
                foo2:bar2'.

I was somewhat surprised to find that there isn't a container.labels or docker.labels filter for any docker labels on the container. We're heavy users of ECS, so having the ability to filter on plain docker labels would be helpful.

[luca3m]

It's not yet implemented but it can be done easily, check this file: https://github.com/draios/sysdig/blob/dev/userspace/libsinsp/filterchecks.cpp#L5463

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.