Q&A

[OhGlacer]

Question

Hi!
Currently working with vector-0.45.0-distroless-libc version.
Main goal is to get logs from a k8s worker host machine, i chose to use an journald source.

As I can see, the only way to get journald source working in distroless image is to mount journalctl binary and libraries required for its launch (additionally to the existing volumes in default daemonset provided at https://github.com/vectordotdev/vector/blob/master/distribution/kubernetes/vector-agent/daemonset.yaml).
Am I correct, or I can use journald source without manually providing binary and libs in daemonset?

Vector Config

No response

Vector Logs

No response

[cookesan]

You are reading it correctly for the distroless image.

The journald source does not read the journal directly from Vector code. It starts a journalctl subprocess. The source has a journalctl_path option, defaults to looking for journalctl, first runs journalctl --version, then starts it with arguments like:

--follow
--all
--show-cursor
--output=json

The generated agent DaemonSet mounts host paths such as /var/log, /var/lib, /host/proc, and /host/sys, but it does not mount a journalctl executable. The distroless-libc image Dockerfile also only copies Vector, Vector config/share/doc files, /var/lib/vector, and the staged zlib dependency into a distroless base; it does not install systemd tooling.

So with vector:*-distroless-libc, a journald source still needs a usable journalctl inside the container environment. Practically that means one of these:

use an image that includes journalctl and its runtime libraries
build a small custom Vector image that includes them
mount the host journalctl plus the required shared libraries and set journalctl_path

Mounting the journal files alone is not enough for this source if the executable cannot be started. If you stay with distroless, I would make journalctl_path explicit in the Vector config so the failure mode is clear and not dependent on PATH.