[BUG] - Agentsight deployed via Docker container not picking up network logs

[AndriyNovykov]

Describe the bug
Deployed agentsight via Docker to monitor claude instances. Network logs are not getting picked up.

To Reproduce

1. Deploy agentsight

docker run --name agentsight -d --rm --privileged --pid=host --network=host -v /sys:/sys:ro -v /var/log/agentsight:/logs ghcr.io/eunomia-bpf/agentsight:latest record --comm claude --log-file /logs/record.log --server-port 80

2. Run claude

Expected behavior
We should be seeing network traffic logs, prompts, and ai responses.

Screenshots

Desktop (please complete the following information):

• OS: Ubuntu 24.04
• Version: 6.8.0-86-generic
• Claude: v2.0.32

[yunwei37]

It can pick it up network logs when we test it last time, and we were using claude code to test it. We will try again and see if there is any new bugs or many claude has update their code.

we are also testing using reverse proxy / TLS interception with self-signed CA to have more robust web traffic sniff, so it can work better than current SSL sniff. https://github.com/eunomia-bpf/agentsight/tree/master/docs/proxy

[yunwei37]

It seems to be some document issues. You can try:

 docker run --privileged --pid=host -p 7395:7395 -v /usr:/usr:ro -v /lib:/lib:ro -v $(pwd)/logs:/logs   ghcr.io/eunomia-bpf/agentsight:latest record --comm claude --log-file /logs/record.log

[yunwei37]

It'm testing it with codex / claude code / python and others and see if it can work for all of them.

[AndriyNovykov]

The cmd you provided doesn't pick up file io when I try to monitor claude.

record.log

[AndriyNovykov]

But this cmd seems to work: docker run --name agentsight -d --rm --privileged --pid=host --network=host -v /usr:/usr:ro -v /lib:/lib:ro -v /sys:/sys:ro -v /root/logs:/logs ghcr.io/eunomia-bpf/agentsight:latest record --comm claude --log-file /logs/record.log

I added /usr:/usr:ro and /lib:/lib:rp.

record.log

[yunwei37]

The sslsniff needs to mount to the ssl library to get the traffic, the ssl library can be in the /usr
or in the /lib, depends on the os or environments. So we may need to mount both of them. If the ssl library or the target hooked library is in other dir, you also need to mount them into the docker.

The process and file monitor needs /sys to get the pid information, so it needs all of them.

[yunwei37]

Seems I forgot to add the /sys in last night comment...

We will update and restruct the document with correct command and notes about how to use them. Thanks!

[AndriyNovykov]

What other dirs might the ssl library be located besides /lib or /usr? We recently tried deploying agentsight via Docker on an Amazon EC2 VM with both /usr and /lib and we aren't able to capture network traffic.

[yunwei37]

Seems on Amazon Linux 2023 specifically, shared libraries live under /usr/lib64, not /usr/lib. https://docs.aws.amazon.com/linux/al2023/ug/filesystem-slash-usr.html

[yunwei37]

A complete list could be:

[yunwei37]

System roots

• /lib
• /lib64
• /usr/lib
• /usr/lib64
• /lib32
• /usr/lib32

Debian / Ubuntu multiarch (generate from triplet if you want)

• /lib/x86_64-linux-gnu
• /usr/lib/x86_64-linux-gnu
• /lib/i386-linux-gnu
• /usr/lib/i386-linux-gnu
• /lib/aarch64-linux-gnu
• /usr/lib/aarch64-linux-gnu
• /lib/arm-linux-gnueabihf
• /usr/lib/arm-linux-gnueabihf
• /lib/riscv64-linux-gnu
• /usr/lib/riscv64-linux-gnu

Local and default OpenSSL build locations

• /usr/local/lib
• /usr/local/lib64
• /usr/local/ssl/lib (OpenSSL’s default prefix)[Stack Overflow+2OpenSSL Wiki+2](https://stackoverflow.com/questions/24959340/which-directory-is-the-openssldir?utm_source=chatgpt.com)

Common /opt layouts

• /opt/local/lib
• /opt/local/lib64
• /opt/openssl/lib
• /opt/openssl*/lib

I think we can find better ways to maintain that.....

[AndriyNovykov]

What would be a better solution here?

We're also running into a similar issue, no network traffic, when trying to monitor claude when claude is running inside an ubuntu container. But not when claude is running on the host machine.