Limitations and security

Docker limitations

There are performance limitations related to the number of running containers. The total number of containers that can be monitored in parallel isn't strictly defined though; this depends on the type of monitored applications and host resources.

Classic Full Stack auto-instrumentation security disclosure

During auto-instrumentation of containers, OneAgent provides access (via mount point) to specific directories on the root filesystem from inside the container. This is required to utilize OneAgent installation inside the container without creating copies of code modules for each container.

That is possible when OneAgent is either

This behavior requires that container auto-instrumentation be enabled.

Directories accessible from inside the container:

  • Installation directory—provides OneAgent code modules
  • Config directory—provides shared OneAgent configuration and stores configuration specific to a process group
    • Data Storage directory—dedicated to storing large runtime data produced by OneAgent
  • Log directory—non-volatile logging from code modules and infrastructure modules

The root users inside instrumented containers have unrestricted access to the above directories on the host filesystem. This can potentially be used for container escape or resource exhaustion.