Skip to main content

walk_cgroups

Function walk_cgroups 

Source
pub fn walk_cgroups<P: PhysicalMemoryProvider>(
    reader: &ObjectReader<P>,
    processes: &[ProcessInfo],
) -> Result<Vec<CgroupInfo>>
Expand description

Walk cgroup membership information for each process in the provided list.

Reads task_struct.cgroups (pointer to css_set) for each process, then traverses css_set.cg_links to find cgroup_subsys_state entries. Reads the cgroup path from the cgroup.kn.name chain. Classifies each process for containerization and suspicious indicators.

Processes whose cgroup information is unreadable are silently skipped (graceful degradation).