github.com/inspektor-gadget/inspektor-gadget@v0.28.1/docs/builtin-gadgets/trace/mount.md (about)

     1  ---
     2  title: 'Using trace mount'
     3  weight: 20
     4  description: >
     5    Trace mount and umount system calls.
     6  ---
     7  
     8  The trace mount gadget is used to monitor `mount` and `umount` syscalls.
     9  In this guide, we will learn how to use it by running a small Kubernetes cluster inside `minikube`.
    10  
    11  ### On Kubernetes
    12  
    13  First, we need to create two pods for us to play with:
    14  
    15  ```bash
    16  $ kubectl run busybox-0 --image busybox:latest sleep inf
    17  $ kubectl run busybox-1 --image busybox:latest sleep inf
    18  ```
    19  
    20  You can now use the gadget, but output will be empty:
    21  
    22  ```bash
    23  $ kubectl gadget trace mount
    24  K8S.NODE         K8S.NAMESPACE    K8S.POD          K8S.CONTAINER    COMM             PID     TID     MNTNS      CALL
    25  ```
    26  
    27  Indeed, it is waiting for `mount` and `umount` to be called.
    28  So, in *another terminal*, `exec` a container and try to `mount` something:
    29  
    30  ```bash
    31  $ kubectl get pods
    32  NAME        READY   STATUS    RESTARTS   AGE
    33  busybox-0   1/1     Running   0          13s
    34  busybox-1   1/1     Running   0          2m3s
    35  $ kubectl exec -ti busybox-0 -- mount /mnt /mnt
    36  mount: mounting /mnt on /mnt failed: No such file or directory
    37  command terminated with exit code 255
    38  ```
    39  
    40  Go back to *the first terminal* and see:
    41  
    42  ```bash
    43  K8S.NODE         K8S.NAMESPACE    K8S.POD          K8S.CONTAINER    COMM             PID     TID     MNTNS      CALL
    44  minikube         default          busybox-0        busybox-0        mount            12841   12841   4026532682  mount("/mnt", "/mnt", "ext3", MS_SILENT, "") = -2
    45  minikube         default          busybox-0        busybox-0        mount            12841   12841   4026532682  mount("/mnt", "/mnt", "ext2", MS_SILENT, "") = -2
    46  minikube         default          busybox-0        busybox-0        mount            12841   12841   4026532682  mount("/mnt", "/mnt", "ext4", MS_SILENT, "") = -2
    47  minikube         default          busybox-0        busybox-0        mount            12841   12841   4026532682  mount("/mnt", "/mnt", "vfat", MS_SILENT, "") = -2
    48  minikube         default          busybox-0        busybox-0        mount            12841   12841   4026532682  mount("/mnt", "/mnt", "msdos", MS_SILENT, "") = -2
    49  minikube         default          busybox-0        busybox-0        mount            12841   12841   4026532682  mount("/mnt", "/mnt", "iso9660", MS_SILENT, "") = -2
    50  minikube         default          busybox-0        busybox-0        mount            12841   12841   4026532682  mount("/mnt", "/mnt", "fuseblk", MS_SILENT, "") = -2
    51  minikube         default          busybox-0        busybox-0        mount            12841   12841   4026532682  mount("/mnt", "/mnt", "xfs", MS_SILENT, "") = -2
    52  ```
    53  
    54  All these lines correspond to the error we get from `mount` inside the pod.
    55  
    56  #### Clean everything
    57  
    58  Congratulations! You reached the end of this guide!
    59  You can now delete the two pods we created:
    60  
    61  ```bash
    62  $ kubectl delete pod busybox-0 busybox-1
    63  pod "busybox-0" deleted
    64  pod "busybox-1" deleted
    65  ```
    66  
    67  ### With `ig`
    68  
    69  Let's start the gadget in a terminal:
    70  
    71  ```bash
    72  $ sudo ig trace mount -c test-trace-mount
    73  RUNTIME.CONTAINERNAME             COMM             PID        TID        CALL
    74  ```
    75  
    76  Run a container that uses mount:
    77  
    78  ```bash
    79  $ docker run --name test-trace-mount -it --rm busybox /bin/sh -c "mount /bar /foo"
    80  ```
    81  
    82  The tool will show the different mount() calls that the container performed:
    83  
    84  ```bash
    85  $ sudo ig trace mount -c test-trace-mount
    86  RUNTIME.CONTAINERNAME             COMM             PID        TID        CALL
    87  test-trace-mount                  mount            235385     235385     mount("/bar", "/foo", "ext3", MS_SILENT, "") = -2
    88  test-trace-mount                  mount            235385     235385     mount("/bar", "/foo", "ext2", MS_SILENT, "") = -2
    89  test-trace-mount                  mount            235385     235385     mount("/bar", "/foo", "ext4", MS_SILENT, "") = -2
    90  test-trace-mount                  mount            235385     235385     mount("/bar", "/foo", "squashf", MS_SILENT, "") = -2
    91  test-trace-mount                  mount            235385     235385     mount("/bar", "/foo", "vfat", MS_SILENT, "") = -2
    92  test-trace-mount                  mount            235385     235385     mount("/bar", "/foo", "fuseblk", MS_SILENT, "") = -2
    93  test-trace-mount                  mount            235385     235385     mount("/bar", "/foo", "btrfs", MS_SILENT, "") = -2
    94  ```