Makefile.tracee-container

#
# Responsible for creating the official tracee container images
#

.PHONY: all
all: help

#
# make
#

.ONESHELL:
SHELL = /bin/sh

MAKEFLAGS += --no-print-directory

#
# tools
#

CMD_DOCKER ?= docker
CMD_RM ?= rm

.check_%:
#
	@command -v $* >/dev/null
	if [ $$? -ne 0 ]; then
		echo "missing required tool $*"
		exit 1
	else
		touch $@ # avoid target rebuilds due to inexistent file
	fi

#
# usage
#

.PHONY: help
help:
	@echo ""
	@echo "To generate tracee containers:"
	@echo ""
	@echo "    $$ make -f builder/Makefile.tracee-container build-tracee"
	@echo "    $$ make -f builder/Makefile.tracee-container build-tracee-full"
	@echo ""
	@echo "To execute tracee containers:"
	@echo ""
	@echo "    $$ make -f builder/Makefile.tracee-container run-tracee"
	@echo "    $$ make -f builder/Makefile.tracee-container run-tracee-ebpf"
	@echo ""
	@echo "    $$ make -f builder/Makefile.tracee-container run-tracee-full"
	@echo "    $$ make -f builder/Makefile.tracee-container run-tracee-ebpf-full"
	@echo ""
	@echo "Note: You may provide \"run\" arguments using the ARG variable."
	@echo ""
	@echo "Example:"
	@echo ""
	@echo "    $$ make -f builder/Makefile.tracee-container build-tracee"
	@echo ""
	@echo "    $$ make -f builder/Makefile.tracee-container run-tracee-ebpf-full \ "
	@echo "          ARG=\"--debug -trace comm=bash --trace follow'\" "
	@echo ""

#
# requirements
#

.PHONY: .check_tree
.check_tree:
#
	@if [ ! -d ./builder ]; then
		echo "you must be in the root directory"
		exit 1
	fi

#
# create tracee & tracee-full
#

# BTFHUB is not set by default, but both of the official images, slim and full,
# should be built with BTFHUB=1. This will maximize chances of end user using
# the slim image AND also allow end user to pick the full image for all use
# cases (if that is what one wants).
ifeq ($(BTFHUB),)
BTFHUB=0
endif

TRACEE_CONT_NAME = tracee:latest
TRACEE_FULL_CONT_NAME = tracee:full

TRACEE_CONT_DOCKERFILE = builder/Dockerfile.alpine-tracee-container

.PHONY: build-tracee
build-tracee: \
	| .check_$(CMD_DOCKER) \
	.check_tree
#
	$(CMD_DOCKER) build \
		-f $(TRACEE_CONT_DOCKERFILE) \
		-t $(TRACEE_CONT_NAME) \
		--build-arg=BTFHUB=$(BTFHUB) \
		--build-arg=FLAVOR=tracee-core \
		--target tracee-core \
		.
	$(CMD_DOCKER) images \
		--filter "label=AS=tracee-make" \
		--format "{{.ID}}" \
		| xargs $(CMD_DOCKER) rmi

.PHONY: build-tracee-full
build-tracee-full: \
	| .check_$(CMD_DOCKER) \
	.check_tree
#
	$(CMD_DOCKER) build \
		-f $(TRACEE_CONT_DOCKERFILE) \
		-t $(TRACEE_FULL_CONT_NAME) \
		--build-arg=BTFHUB=$(BTFHUB) \
		--build-arg=FLAVOR=tracee-nocore \
		--target tracee-nocore \
		.
	$(CMD_DOCKER) images \
		--filter "label=AS=tracee-make" \
		--format "{{.ID}}" \
		| xargs $(CMD_DOCKER) rmi

#
# run tracee and tracee-full
#

DOCKER_RUN_ARGS = run --rm --pid=host --privileged \
		-v /etc/os-release:/etc/os-release-host:ro \
		-v /sys/kernel/security:/sys/kernel/security:ro \
		-e LIBBPFGO_OSRELEASE_FILE=/etc/os-release-host \
		-v /tmp/tracee:/tmp/tracee:rw

DOCKER_RUN_ARGS_FULL = $(DOCKER_RUN_ARGS) \
		-v /lib/modules:/lib/modules:ro \
		-v /usr/src:/usr/src:ro

.PHONY: run-tracee
run-tracee: \
	| .check_$(CMD_DOCKER) \
	.check_tree
#
	$(CMD_DOCKER) \
		$(DOCKER_RUN_ARGS) \
		-e TRACEE_EBPF_ONLY=0 \
		--rm -it $(TRACEE_CONT_NAME) \
		$(ARG)

.PHONY: run-tracee-full
run-tracee-full: \
	| .check_$(CMD_DOCKER) \
	.check_tree
#
	$(CMD_DOCKER) \
		$(DOCKER_RUN_ARGS_FULL) \
		-e TRACEE_EBPF_ONLY=0 \
		-e FORCE_CORE=0 \
		--rm -it $(TRACEE_FULL_CONT_NAME) \
		$(ARG)

#
# run tracee-ebpf or tracee-ebpf-full
#

.PHONY: run-tracee-ebpf
run-tracee-ebpf: \
	| .check_$(CMD_DOCKER) \
	.check_tree
#
	$(CMD_DOCKER) \
		$(DOCKER_RUN_ARGS) \
		-e TRACEE_EBPF_ONLY=1 \
		--rm -it $(TRACEE_CONT_NAME) \
		$(ARG)

.PHONY: run-tracee-ebpf-full
run-tracee-ebpf-full: \
	| .check_$(CMD_DOCKER) \
	.check_tree
#
	$(CMD_DOCKER) \
		$(DOCKER_RUN_ARGS_FULL) \
		-e TRACEE_EBPF_ONLY=1 \
		-e FORCE_CORE=0 \
		--rm -it $(TRACEE_FULL_CONT_NAME) \
		$(ARG)

#
# clean
#

.PHONY: clean
clean:
	$(MAKE) clean