main.go

package main

import (
	"context"
	"errors"
	"log"
	"os"
	"os/signal"
	"syscall"
	"time"

	"github.com/cilium/ebpf/ringbuf"
	containerd "github.com/containerd/containerd/v2/client"

	"github.com/vanstee/exec-record/asciicast"
	"github.com/vanstee/exec-record/config"
	"github.com/vanstee/exec-record/ebpf"
	"github.com/vanstee/exec-record/informers"
)

func main() {
	// TODO: Validate config, directories exist, etc
	config := config.Parse()

	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
	defer stop()

	client, err := containerd.New(config.ContainerdRuntimeEndpoint)
	if err != nil {
		log.Fatalf("failed to create containerd client: %v", err)
	}
	defer client.Close()

	informer, err := informers.NewContainerdInformer(client)
	if err != nil {
		log.Fatalf("failed to initalize containerd informer: %v", err)
	}

	if err := informer.Start(ctx); err != nil {
		log.Fatalf("failed to start containerd informer: %v", err)
	}
	log.Printf("started containerd informer")

	watcher, err := ebpf.StartWatcher(ctx)
	if err != nil {
		log.Fatalf("failed to start exec io watcher: %v", err)
	}
	defer watcher.Close()
	log.Printf("started ebpf event watcher")

	for {
		event, err := watcher.Read()
		if err != nil && errors.Is(err, ringbuf.ErrClosed) {
			log.Printf("ringbuf closed, exiting")
			return
		} else if err != nil {
			log.Printf("failed to read from ringbuf: %v", err)
			continue
		}

		ok, containerID, execID := informer.MatchingTask(event.TtyNr)
		if !ok {
			continue
		}

		recordingPath := config.RecordingsDir + "/" + containerID + "-" + execID + ".cast"
		since := time.Duration(event.Since)
		if err := asciicast.AppendEventToRecording(recordingPath, since.Seconds(), event.Buf, event.Pid); err != nil {
			log.Printf("failed to record event: %v", err)
		}

		log.Printf("event: %b %10d %10d  %q", event.TtyNr, event.Pid, event.Ns, event.Buf)
	}
}