container event Attributes mixes unrelated namespaces and scopes

[martinpitt]

Issue Description

Noticed in the context of #19124. Every single "container" event has the Attributes map -- most of these are properties of the image; they can be freely defined by Containerfile, have a considerable size, and will never change for an image, so they shouldn't be logged again for each event. That should greatly reduce the amount of journal size?

But more importantly: The .Attributes map also contains the podId and containerExitCode: These are container runtime propertyies, not a static image ones. This mixes different kinds of namespaces, i.e. has the possibility of collisions (in principle, a Containerfile could define a podId attribute), and also different kinds of scopes (image vs. container).

"Attributes":{"com.jitesoft.app.alpine.version":"3.18.2","com.jitesoft.build.arch":"amd64","com.jitesoft.build.platform":"linux/amd64","com.jitesoft.project.registry.uri":"registry.gitlab.com/jitesoft/dockerfiles/alpine","com.jitesoft.project.repo.issues":"https://gitlab.com/jitesoft/dockerfiles/alpine/issues","com.jitesoft.project.repo.type":"git","com.jitesoft.project.repo.uri":"https://gitlab.com/jitesoft/dockerfiles/alpine","containerExitCode":"0","image":"localhost/test-alpine:latest","io.artifacthub.package.alternative-locations":"oci://index.docker.io/jitesoft/alpine,oci://ghcr.io/jitesoft/alpine","io.artifacthub.package.logo-url":"https://jitesoft.com/favicon-96x96.png","io.artifacthub.package.readme-url":"https://gitlab.com/jitesoft/dockerfiles/alpine/-/raw/master/README.md","maintainer ":"Johannes Tegnér \u003cjohannes@jitesoft.com\u003e","maintainer.org":"Jitesoft","maintainer.org.uri":"https://jitesoft.com","name":"test-sh4","org.opencontainers.image.created":"2023-06-15T12:04:35+00:00","org.opencontainers.image.description":"Alpine linux","org.opencontainers.image.source":"https://gitlab.com/jitesoft/dockerfiles/alpine","org.opencontainers.image.vendor":"Jitesoft","org.opencontainers.image.version":"3.18.2","podId":""}}

Steps to reproduce the issue

Steps to reproduce the issue

systemctl --user start podman.socket
curl --unix /run/user/1000/podman/podman.sock -v http://dummy/v1.12/libpod/events

and in another terminal:

podman run quay.io/jitesoft/alpine true

Describe the results you received

See description. Example of an attach event, but they all look the same wrt. .Attributes:

{"status":"attach","id":"2b4520b5bfc2ad6c1def6784fbcd32f07e4f233cccfbd99673eeafb8edd744e8","from":"quay.io/jitesoft/alpine:latest","Type":"container","Action":"attach","Actor":{"ID":"2b4520b5bfc2ad6c1def6784fbcd32f07e4f233cccfbd99673eeafb8edd744e8","Attributes":{"com.jitesoft.app.alpine.version":"3.18.2","com.jitesoft.build.arch":"amd64","com.jitesoft.build.platform":"linux/amd64","com.jitesoft.project.registry.uri":"registry.gitlab.com/jitesoft/dockerfiles/alpine","com.jitesoft.project.repo.issues":"https://gitlab.com/jitesoft/dockerfiles/alpine/issues","com.jitesoft.project.repo.type":"git","com.jitesoft.project.repo.uri":"https://gitlab.com/jitesoft/dockerfiles/alpine","containerExitCode":"0","image":"quay.io/jitesoft/alpine:latest","io.artifacthub.package.alternative-locations":"oci://index.docker.io/jitesoft/alpine,oci://ghcr.io/jitesoft/alpine","io.artifacthub.package.logo-url":"https://jitesoft.com/favicon-96x96.png","io.artifacthub.package.readme-url":"https://gitlab.com/jitesoft/dockerfiles/alpine/-/raw/master/README.md","maintainer":"Johannes Tegnér \u003cjohannes@jitesoft.com\u003e","maintainer.org":"Jitesoft","maintainer.org.uri":"https://jitesoft.com","name":"upbeat_brown","org.opencontainers.image.created":"2023-06-15T12:04:35+00:00","org.opencontainers.image.description":"Alpine linux","org.opencontainers.image.source":"https://gitlab.com/jitesoft/dockerfiles/alpine","org.opencontainers.image.vendor":"Jitesoft","org.opencontainers.image.version":"3.18.2","podId":""}},"scope":"local","time":1688609876,"timeNano":1688609876656350224}

Describe the results you expected

• static image properties should either not appear at all in container events, as they are a property of an image, not a container; or at least only in created.
• podId, containerExitCode (and possibly other attributes) should be in a different key, like Actor or make them top-level attributes.

podman info output

host:
  arch: amd64
  buildahVersion: 1.30.0
  cgroupControllers:
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.7-2.fc38.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.7, commit: '
  cpuUtilization:
    idlePercent: 61.92
    systemPercent: 5.53
    userPercent: 32.55
  cpus: 8
  databaseBackend: boltdb
  distribution:
    distribution: fedora
    version: "38"
  eventLogger: journald
  hostname: abakus
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
  kernel: 6.3.10-200.fc38.x86_64
  linkmode: dynamic
  logDriver: journald
  memFree: 1776160768
  memTotal: 16517193728
  networkBackend: netavark
  ociRuntime:
    name: crun
    package: crun-1.8.5-1.fc38.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.8.5
      commit: b6f80f766c9a89eb7b1440c0a70ab287434b17ed
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.2.0-12.fc38.x86_64
    version: |-
      slirp4netns version 1.2.0
      commit: 656041d45cfca7a4176f6b7eed9e4fe6c11e8383
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.5.3
  swapFree: 0
  swapTotal: 0
  uptime: 102h 57m 23.00s (Approximately 4.25 days)
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
  - quay.io
store:
  configFile: /var/home/martin/.config/containers/storage.conf
  containerStore:
    number: 6
    paused: 0
    running: 2
    stopped: 4
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/martin/.local/share/containers/storage
  graphRootAllocated: 228501188608
  graphRootUsed: 179675779072
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 9
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /home/martin/.local/share/containers/storage/volumes
version:
  APIVersion: 4.5.1
  Built: 1685123928
  BuiltTime: Fri May 26 19:58:48 2023
  GitCommit: ""
  GoVersion: go1.20.4
  Os: linux
  OsArch: linux/amd64
  Version: 4.5.1

Podman in a container

No

Privileged Or Rootless

Rootless

Upstream Latest Release

No

Additional environment details

Additional environment details

Additional information

Additional information like issue happens only occasionally or issue happens with a particular architecture or on a particular setting

[Luap99]

AFAIK Attributes are supposed to carry the labels, as a container gets labels from the image they will be included there as well. While they are static it is required to store them in each single message, the log can get truncated at any given time and after you removed the container they will be no longer accessible in the podman db either. Thus it would be impossible to filter on label correctly.

I think this is mostly how it work with docker as well but we should double check.

As for as thinks like podID I agree, they should not be there. This is mostly the result of people just looking at the cli and not how it looks in the json API. Also the fact that podID shouldn't even be added if the container is not part of a pod.

[martinpitt]

Ack, the repetition is just an optimization (and mostly an annoyance when staring at logs), if it has a purpose, then let's ignore that part.

Also the fact that podID shouldn't even be added if the container is not part of a pod.

Yeah, "podId": "" is a bit ugly; it should at least be null (JSON has that), or absent.

[martinpitt]

The same applies to containerExitCode, I updated the description accordingly.

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[martinpitt]

bump

[github-actions]

A friendly reminder that this issue had no activity for 30 days.