[CWS] do not use the parent cgroup as a fallback (#49243)#49439
Conversation
safchain
added
changelog/no-changelog
|
Backport evaluation pending. This is a placeholder — AI evaluation coming soon. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3702df0620
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| // try to resolve the cgroup from the dentry resolver | ||
| if cacheEntry := cr.resolveAndPushNewCacheEntry(pid, cgroupContext, createdAt); cacheEntry != nil { | ||
| return cacheEntry | ||
| } | ||
| } | ||
|
|
||
| return cr.resolveFromFallback(pid, ppid) | ||
| return cr.resolveFromFallback(pid) |
There was a problem hiding this comment.
When AddPID receives a non-null cgroupContext and no existing cache entry matches, this branch now skips resolveAndPushNewCacheEntry and immediately falls back to FindCGroupContext(pid, pid). That drops valid associations for short-lived processes whose /proc cgroup lookup races/fails, even though we already have enough cgroup metadata (path key / resolved ID) from the event to create a correct cache entry. This is a behavioral regression from the previous logic and will increase missed cgroup/container attribution in normal process-start races.
Useful? React with 👍 / 👎.
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
sylvain.afchain@datadoghq.com cancelled this merge request build |
|
/merge --cancel |
|
View all feedbacks in Devflow UI.
|
safchain
force-pushed
the
safchain/backport-cgroup-fallback
branch
from
3702df0 to
a22103f
Compare
Using the parent cgroup as a fallback when cgroup resolution fails is dangerous: a process may legitimately belong to a different cgroup than its parent (e.g. when a new container is being spawned), so inheriting the parent cgroup produces an incorrect association. This is especially risky for remediation: if a policy action (such as killing a container) is triggered on an event whose cgroup was resolved from the parent, the remediation targets the wrong container, causing unintended disruption. Remove the two parent-cgroup fallback paths. When cgroup resolution fails the entry is now simply dropped instead of being mis-attributed. Co-authored-by: sylvain.afchain <sylvain.afchain@datadoghq.com> (cherry picked from commit 171ea79)
safchain
force-pushed
the
safchain/backport-cgroup-fallback
branch
from
a22103f to
9c57273
Compare
Files inventory check summaryFile checks results against ancestor a1446fd8: Results for datadog-agent_7.78.0.git.11.9c57273.pipeline.107994590-1_amd64.deb:No change detected |
Regression DetectorRegression Detector ResultsMetrics dashboard Baseline: a1446fd Optimization Goals: ✅ No significant changes detected
|
| perf | experiment | goal | Δ mean % | Δ mean % CI | trials | links |
|---|---|---|---|---|---|---|
| ➖ | docker_containers_cpu | % cpu utilization | +2.87 | [-0.21, +5.94] | 1 | Logs |
Fine details of change detection per experiment
| perf | experiment | goal | Δ mean % | Δ mean % CI | trials | links |
|---|---|---|---|---|---|---|
| ➖ | docker_containers_cpu | % cpu utilization | +2.87 | [-0.21, +5.94] | 1 | Logs |
| ➖ | ddot_metrics_sum_cumulativetodelta_exporter | memory utilization | +0.42 | [+0.19, +0.64] | 1 | Logs |
| ➖ | tcp_syslog_to_blackhole | ingress throughput | +0.38 | [+0.25, +0.51] | 1 | Logs |
| ➖ | otlp_ingest_logs | memory utilization | +0.35 | [+0.24, +0.45] | 1 | Logs |
| ➖ | quality_gate_metrics_logs | memory utilization | +0.34 | [+0.10, +0.57] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_logs | % cpu utilization | +0.30 | [-1.24, +1.83] | 1 | Logs bounds checks dashboard |
| ➖ | file_tree | memory utilization | +0.23 | [+0.18, +0.28] | 1 | Logs |
| ➖ | ddot_metrics | memory utilization | +0.21 | [+0.02, +0.39] | 1 | Logs |
| ➖ | ddot_logs | memory utilization | +0.14 | [+0.08, +0.20] | 1 | Logs |
| ➖ | uds_dogstatsd_20mb_12k_contexts_20_senders | memory utilization | +0.10 | [+0.04, +0.17] | 1 | Logs |
| ➖ | ddot_metrics_sum_cumulative | memory utilization | +0.08 | [-0.06, +0.23] | 1 | Logs |
| ➖ | file_to_blackhole_500ms_latency | egress throughput | +0.06 | [-0.33, +0.46] | 1 | Logs |
| ➖ | uds_dogstatsd_to_api | ingress throughput | +0.00 | [-0.20, +0.20] | 1 | Logs |
| ➖ | tcp_dd_logs_filter_exclude | ingress throughput | +0.00 | [-0.11, +0.11] | 1 | Logs |
| ➖ | file_to_blackhole_100ms_latency | egress throughput | -0.01 | [-0.10, +0.08] | 1 | Logs |
| ➖ | uds_dogstatsd_to_api_v3 | ingress throughput | -0.01 | [-0.21, +0.19] | 1 | Logs |
| ➖ | ddot_metrics_sum_delta | memory utilization | -0.03 | [-0.20, +0.15] | 1 | Logs |
| ➖ | quality_gate_idle_all_features | memory utilization | -0.05 | [-0.08, -0.01] | 1 | Logs bounds checks dashboard |
| ➖ | file_to_blackhole_1000ms_latency | egress throughput | -0.05 | [-0.49, +0.38] | 1 | Logs |
| ➖ | quality_gate_idle | memory utilization | -0.13 | [-0.18, -0.08] | 1 | Logs bounds checks dashboard |
| ➖ | file_to_blackhole_0ms_latency | egress throughput | -0.15 | [-0.61, +0.32] | 1 | Logs |
| ➖ | docker_containers_memory | memory utilization | -0.48 | [-0.55, -0.41] | 1 | Logs |
| ➖ | otlp_ingest_metrics | memory utilization | -0.54 | [-0.70, -0.39] | 1 | Logs |
Bounds Checks: ❌ Failed
| perf | experiment | bounds_check_name | replicates_passed | observed_value | links |
|---|---|---|---|---|---|
| ✅ | docker_containers_cpu | simple_check_run | 10/10 | 705 ≥ 26 | |
| ✅ | docker_containers_memory | memory_usage | 10/10 | 280.39MiB ≤ 370MiB | |
| ✅ | docker_containers_memory | simple_check_run | 10/10 | 730 ≥ 26 | |
| ✅ | file_to_blackhole_0ms_latency | memory_usage | 10/10 | 0.19GiB ≤ 1.20GiB | |
| ✅ | file_to_blackhole_0ms_latency | missed_bytes | 10/10 | 0B = 0B | |
| ✅ | file_to_blackhole_1000ms_latency | memory_usage | 10/10 | 0.23GiB ≤ 1.20GiB | |
| ✅ | file_to_blackhole_1000ms_latency | missed_bytes | 10/10 | 0B = 0B | |
| ✅ | file_to_blackhole_100ms_latency | memory_usage | 10/10 | 0.20GiB ≤ 1.20GiB | |
| ✅ | file_to_blackhole_100ms_latency | missed_bytes | 10/10 | 0B = 0B | |
| ✅ | file_to_blackhole_500ms_latency | memory_usage | 10/10 | 0.21GiB ≤ 1.20GiB | |
| ✅ | file_to_blackhole_500ms_latency | missed_bytes | 10/10 | 0B = 0B | |
| ✅ | quality_gate_idle | intake_connections | 10/10 | 3 = 3 | bounds checks dashboard |
| ❌ | quality_gate_idle | memory_usage | 9/10 | 175.06MiB > 175MiB | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | intake_connections | 10/10 | 2 ≤ 3 | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | memory_usage | 10/10 | 489.28MiB ≤ 550MiB | bounds checks dashboard |
| ✅ | quality_gate_logs | intake_connections | 10/10 | 4 ≤ 6 | bounds checks dashboard |
| ✅ | quality_gate_logs | memory_usage | 10/10 | 206.20MiB ≤ 220MiB | bounds checks dashboard |
| ✅ | quality_gate_logs | missed_bytes | 10/10 | 0B = 0B | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | cpu_usage | 10/10 | 370.02 ≤ 2000 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | intake_connections | 10/10 | 4 ≤ 6 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | memory_usage | 10/10 | 412.40MiB ≤ 475MiB | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | missed_bytes | 10/10 | 0B = 0B | bounds checks dashboard |
Explanation
Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%
Performance changes are noted in the perf column of each table:
- ✅ = significantly better comparison variant performance
- ❌ = significantly worse comparison variant performance
- ➖ = no significant change in performance
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".
CI Pass/Fail Decision
❌ Failed. Some Quality Gates were violated.
- quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check memory_usage: 9/10 replicas passed. Failed 1 which is > 0. Gate FAILED.
- quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
|
Static quality checks✅ Please find below the results from static quality gates Successful checksInfo
17 successful checks with minimal change (< 2 KiB)
On-wire sizes (compressed)
|
gh-worker-dd-mergequeue-cf854d
bot
merged commit 83c265b
into
7.78.x
gh-worker-dd-mergequeue-cf854d
bot
deleted the
safchain/backport-cgroup-fallback
branch
4 participants
Using the parent cgroup as a fallback when cgroup resolution fails is dangerous: a process may legitimately belong to a different cgroup than its parent (e.g. when a new container is being spawned), so inheriting the parent cgroup produces an incorrect association.
This is especially risky for remediation: if a policy action (such as killing a container) is triggered on an event whose cgroup was resolved from the parent, the remediation targets the wrong container, causing unintended disruption.
Remove the two parent-cgroup fallback paths. When cgroup resolution fails the entry is now simply dropped instead of being mis-attributed.
(cherry picked from commit 171ea79)
What does this PR do?
Motivation
Describe how you validated your changes
Additional Notes