get_containers_process_trees
Retrieve process trees for specified containers to analyze runtime behavior and identify potential security risks in Kubernetes and cloud environments.
Instructions
Get process trees for multiple containers
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| container_ids | Yes | List of container IDs to get process trees for | |
| processes_limit | No | Limit the number of processes to get |
Implementation Reference
- src/operations/runtime.ts:70-100 (handler)Main handler function implementing get_containers_process_trees: fetches container runtime insights via API, processes data, limits processes using reduceProcesses helper, and returns process trees keyed by CRI ID.export async function getContainersProcessTrees( client: RadSecurityClient, containerIds: string[], processesLimit: number = 1000 ): Promise<any> { if (containerIds.length === 0) { throw new Error("No container IDs provided"); } const cris = await client.makeRequest( `/accounts/${client.getAccountId()}/container_runtime_insights`, { container_ids: containerIds.join(',') } ); const containersProcessTrees: Record<string, any> = {}; for (const cri of cris.entries) { const criId = cri.id; const data = await client.makeRequest( `/accounts/${client.getAccountId()}/container_runtime_insights/${criId}` ); if (!data.ongoing || !data.ongoing.containers || data.ongoing.containers.length === 0) { containersProcessTrees[criId] = {}; } else { containersProcessTrees[criId] = data.ongoing.containers[0]; containersProcessTrees[criId].processes = reduceProcesses(data.ongoing.containers[0].processes, processesLimit); } } return containersProcessTrees; }
- src/operations/runtime.ts:4-7 (schema)Zod schema defining input parameters for the get_containers_process_trees tool.export const GetContainersProcessTreesSchema = z.object({ container_ids: z.array(z.string()).describe("List of container IDs to get process trees for"), processes_limit: z.number().default(1000).describe("Limit the number of processes to get"), });
- src/index.ts:240-242 (registration)Tool registration in the listTools handler: defines name, description, and input schema for get_containers_process_trees.name: "get_containers_process_trees", description: "Get process trees for multiple containers", inputSchema: zodToJsonSchema(runtime.GetContainersProcessTreesSchema),
- src/index.ts:612-621 (registration)Tool dispatch registration in the callTool handler: parses arguments using schema and invokes the runtime.getContainersProcessTrees handler.case "get_containers_process_trees": { const args = runtime.GetContainersProcessTreesSchema.parse(request.params.arguments); const response = await runtime.getContainersProcessTrees( client, args.container_ids, args.processes_limit ); return { content: [{ type: "text", text: JSON.stringify(response, null, 2) }], };
- src/operations/runtime.ts:102-166 (helper)Helper function to reduce and format process trees to a string array limited by the given number, used within getContainersProcessTrees.function reduceProcesses(processes: any[], limit: number): any[] { if (processes.length === 0 || limit <= 0) { return []; } const countProcesses = (procs: any[]): number => { let total = 0; for (const proc of procs) { total += 1; if (proc.children) { total += countProcesses(proc.children); } } return total; }; const extractProcessTree = (procs: any[], indent: string = "", remainingLimit: number): string[] => { const result: string[] = []; for (const process of procs) { if (result.length >= remainingLimit) { break; } const timestamp = process.timestamp || ""; // Print process info if (process.programs) { for (const program of process.programs) { const comm = program.comm || "unknown"; const args = (program.args || []).join(" "); result.push(`${indent}├─ [${timestamp}] ${comm}: ${args}`); } } // Print connections if any if (process.connections) { for (const conn of process.connections) { const addr = conn.hostname || conn.address || "unknown"; const port = conn.port || "unknown"; const connTime = conn.timestamp || ""; result.push(`${indent}│ └─ Connection to ${addr}:${port} at ${connTime}`); } } // Recursively print children with increased indentation if (process.children) { result.push(...extractProcessTree(process.children, indent + "│ ", remainingLimit - result.length)); } } return result; }; // Extract the process tree const tree = extractProcessTree(processes, "", limit); // Add a note if we hit the limit if (tree.length >= limit) { const totalCount = countProcesses(processes); tree.push(`Processes limit(${limit}) reached. Some processes were not included in the output. Total processes: ${totalCount}`); } return tree; }