-
Notifications
You must be signed in to change notification settings - Fork 431
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
4 changed files
with
55 additions
and
46 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| # Tracee on Apple Mac FAQ | ||
|
|
||
| ## Does Tracee run on MacOS? | ||
|
|
||
| No. Tracee runs only on Linux operating system. But you can run a Linux VM on your Mac, and then run Tracee in it. Please note though, that with this setup Tracee will only have visibility to the Linux VM it is running in, and not the host Mac machine. | ||
|
|
||
| ## Does Tracee run on Apple Silicon? | ||
|
|
||
| Apple Silicon (a.k.a `M#` CPUs) utilizes the ARM64 CPU architecture. Given that [Tracee is compatible with ARM64](../install/prerequisites.md#processor-architecture), it should run on Apple Silicon as well. | ||
|
|
||
| ## Does Tracee run in a Linux container on MacOS? | ||
|
|
||
| Yes. It is very common to install a container engine (e.g Docker Desktop) on MacOS and still be able to run Linux containers. This works by creating a Linux virtual machine inside your MacOS and running the container engine and all your containers from inside it. Note that with this setup Tracee will only have visibility to that Linux VM which is dedicated for the container engine, and not to your Mac machine. If you wanted to run something and see how Tracee reacts to it, you can run it as another container which should be visible to Tracee. | ||
|
|
||
| ## Linuxkit | ||
|
|
||
| [linuxkit](https://github.com/linuxkit/linuxkit) is a popular Linux distribution used by Docker Desktop and other solutions. | ||
| Linux kit does not have the Kernel Symbols Table feature properly configured by default, which is a [prerequisite](../install/prerequisites.md#kernel-symbols) for running Tracee. | ||
| It is technically possible to enable kernel symbols in linuxkit but an easier solution would be to disable [those Tracee events that depend on kernel symbols](../install/prerequisites.md#kernel-symbols). |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,65 +1,53 @@ | ||
| # Docker Quickstart | ||
| # Running Tracee with Docker | ||
|
|
||
| This section details how you can run Tracee through a container image. | ||
| This guide will help you get started with running Tracee as a container. | ||
|
|
||
| ## Prerequisites | ||
|
|
||
| Please ensure that Docker or another container runtime is working on your machine. | ||
| - Review the [prerequisites for running Tracee](./prerequisites.md) | ||
| - If you are an Apple Mac user, please read [the Mac FAQ](../deep-dive/apple.md) | ||
| - Ensure that you have Docker or a compatible container runtime | ||
|
|
||
| ## Run the Tracee container images | ||
| ## Tracee container image | ||
|
|
||
| All of the Tracee container images are stored in a public registry on [Docker Hub.](https://hub.docker.com/r/aquasec/tracee) | ||
| You can easily start experimenting with Tracee using the Docker image. | ||
| Tracee container image is available in Docker Hub as [aquasec/tracee](https://hub.docker.com/r/aquasec/tracee). | ||
|
|
||
| ### On x86 architecture, please run the following command | ||
| - You can use the `latest` tag or a named version version e.g `aquasec/tracee:{{ git.tag }}`. | ||
| - If you are trying the most cutting edge features, there is also a `dev` tag which is built nightly from source. | ||
| - The Tracee image is a [Multi-platform](https://docs.docker.com/build/building/multi-platform/) image that includes a x86 and arm64 flavors. You can also access the platform-specific images directly with the `aarch64` and `x86_64` tags for the latest version or `aarch64-<version>` and `x86_64-<version>` for a specific version. | ||
| - For most first time users, just use `aquasec/tracee`! | ||
|
|
||
| ```console | ||
| ## Running Tracee container | ||
|
|
||
| Here is the docker run command, we will analyze it next: | ||
|
|
||
| ```shell | ||
| docker run \ | ||
| --name tracee --rm -it \ | ||
| --pid=host --cgroupns=host --privileged \ | ||
| -v /etc/os-release:/etc/os-release-host:ro \ | ||
| aquasec/tracee:latest | ||
| ``` | ||
|
|
||
| ### Steps to run the Tracee container image on arm64 | ||
|
|
||
| There are a few more steps involved in running Tracee through a container image on arm64 (M1). | ||
|
|
||
| Prerequisites: | ||
|
|
||
| * [Vagrant CLI](https://developer.hashicorp.com/vagrant/downloads) installed | ||
| * [Parallels Pro](https://www.parallels.com/uk/products/desktop/pro/) installed | ||
| 1. Docker general flags: | ||
| 1.1 `--name` - name our container so that we can interact with it easily. | ||
| 1.2. `--rm` - remove the container one it exits, assuming this is an interactive trial of Tracee. | ||
| 1.3. `-it` - allow the container to interact with your terminal. | ||
| 2. Since Tracee runs in a container but is instrumenting the host, it will need access to some resources from the host: | ||
| 2.2 `--pid=host` - share the host's [process namespace]() with Tracee's container. | ||
| 2.3 `--cgroupns-host` - share the host's [cgroup namespace]() with Tracee's container. | ||
| 2.4 `--privileged` - run the Tracee container as root so it has all the [required capabilities](./prerequisites.md#process-capabilities). | ||
| 2.5 `-v /etc/os-release:/etc/os-release-host:ro` - share the host's [OS information file](./prerequisites.md#os-information) with the Tracee container. | ||
|
|
||
| First, clone the Tracee Git repository and move into the root directory: | ||
| After running this command, you should start seeing a stream of events that Tracee is emitting. | ||
|
|
||
| ```console | ||
| git clone [email protected]:aquasecurity/tracee.git | ||
|
|
||
| cd tracee | ||
| ``` | ||
|
|
||
| Next, use Vagrant to start a Parallels VM: | ||
|
|
||
| ```console | ||
| vagrant up | ||
| ``` | ||
| For next steps, please read about Tracee [Policies](../policies/index.md) | ||
|
|
||
| This will use the [Vagrantfile](https://github.com/aquasecurity/tracee/blob/main/Vagrantfile) in the root of the Tracee directory. | ||
| ## Installing Tracee | ||
|
|
||
| Lastly, ssh into the created VM: | ||
| If you are looking to permanently install Tracee, you would probably do the following: | ||
|
|
||
| ```console | ||
| vagrant ssh | ||
| ``` | ||
|
|
||
| Now, it is possible to run the Tracee Container image: | ||
|
|
||
| ```console | ||
| docker run \ | ||
| --name tracee --rm -it \ | ||
| --pid=host --cgroupns=host --privileged \ | ||
| -v /etc/os-release:/etc/os-release-host:ro \ | ||
| aquasec/tracee:latest | ||
| ``` | ||
| 1. Remove interactive flags `-it` and replace with daemon flag `-d` | ||
| 2. Consider how to collect events from the container. | ||
|
|
||
| To learn how to install Tracee in a production environment, [check out the Kubernetes guide](./kubernetes-quickstart). | ||
| Or you can follow the [Kubernetes guide](./kubernetes.md) which addresses these concerns. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters