linuxkit/docs/kernel-bcc.md

Using the bcc utility with LinuxKit

The bcc utility is a standard Linux tool to access performance counters, trace events and access various other kernel internals for performance analysis.

The bcc utility needs to matched be with the kernel. For recent kernel build, LinuxKit provides a linuxkit/kernel-bcc package with a matching tag for each kernel under linuxkit/kernel.

The preferred way of using the linuxkit/kernel-bcc package is to add it to the init section. This adds /usr/share/bcc to the systems' root filesystem. From there it can be

• bind mounted into your container
• accessed via /proc/1/root/usr/share/bcc/tools from with in the getty or ssh container.
• accessed via a nsenter of /bin/ash of proc 1.

If you want to use bcc you may also want to remove the sysctl container, or alternatively, disable the kernel pointer restriction it enables by default:

echo 0 > /proc/sys/kernel/kptr_restrict

Now, bcc is ready to use. The LinuxKit bcc package contains the bcc binary, example and tool scripts, and kernel headers for the associated kernel build.