查询容器逃逸事件详情

1. 接口描述

接口请求域名： tcss.tencentcloudapi.com 。

DescribeEscapeEventDetail 查询容器逃逸事件详情

默认接口请求频率限制：20次/秒。

2. 输入参数

以下请求参数列表仅列出了接口请求参数和部分公共参数，完整公共参数列表见 公共请求参数。

3. 输出参数

4. 示例

示例1 DescribeEscapeEventDetail

查询容器逃逸事件详情

输入示例

POST / HTTP/1.1
Host: tcss.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeEscapeEventDetail
<公共请求参数>

{
    "EventId": "10021"
}

输出示例

{
    "Response": {
        "AncestorProcessInfo": {
            "ProcessParam": "/usr/lib/systemd/systemd --switched-root --system --deserialize 18 ",
            "ProcessPath": "systemd",
            "ProcessStartUser": "root",
            "ProcessUserGroup": "root"
        },
        "EventBaseInfo": {
            "ClientIP": "159.75.90.111",
            "ClusterID": "cls-sdfw3f3",
            "ClusterName": "web-cluster",
            "ContainerId": "a960d85856c7a77cb504b638c56f59a28057",
            "ContainerIsolateOperationSrc": "system",
            "ContainerName": "node1",
            "ContainerNetStatus": "NORMAL",
            "ContainerNetSubStatus": "NONE",
            "EventCount": 1,
            "EventId": "12486",
            "EventName": "敏感路径挂载",
            "EventType": "MOUNT_SENSITIVE_PTAH",
            "FoundTime": "2024-10-23 17:13:51",
            "HostID": "3b6b1bbc-1c7a-47e2-9ca8-e9c27ec9d068",
            "HostIP": "172.17.1.6",
            "ImageId": "sha256:b760a4831f5aab71c711f7537a107b751d0d0ce90dd32d8b358df3c5da385426",
            "ImageName": "centos:7.6",
            "LatestFoundTime": "2024-10-23 17:13:51",
            "Namespace": "default",
            "NodeID": "web-node1",
            "NodeName": "VM-1-6-tencentos",
            "NodeSubNetCIDR": "172.16.0.0/24",
            "NodeSubNetID": "sub-ndifn***",
            "NodeSubNetName": "dev",
            "NodeType": "NORMAL",
            "NodeUniqueID": "d41d8cd98f00b20*******",
            "PodIP": "10.0.0.121",
            "PodName": "kube-system/cilium-m2gkw",
            "PodStatus": "NORMAL",
            "Status": "EVENT_UNDEAL",
            "WorkloadType": "StatefulSet"
        },
        "EventDetail": {
            "Description": "容器（ID:5893711bb2...）挂载了敏感目录/lib/modules,/proc/sys/net,/proc/sys/kernel，存在容器逃逸的风险，当攻击者攻破容器后，可通过篡改该目录下的敏感文件，从而实现容器逃逸，获得宿主机系统的控制权限，威胁宿主机上其它容器及内网的安全。",
            "OperationTime": "1970-01-01 00:00:01",
            "Remark": "dev",
            "Solution": "修改挂载路径，只将必须的路径挂载到容器中，避免挂载敏感路径。"
        },
        "ParentProcessInfo": {
            "ProcessParam": "/usr/local/bin/containerd-shim-runc-v2 -namespace k8s.io -id 613d6792485871ca66ab6dc4d1c24e827e1ff4ae6aff87b187e40059cd3ba3b9 -address /run/containerd/containerd.sock ",
            "ProcessPath": "containerd-shim-runc-v2",
            "ProcessStartUser": "root",
            "ProcessUserGroup": "root"
        },
        "ProcessInfo": {
            "ProcessAuthority": "-rwxr-xr-x",
            "ProcessId": 2743103,
            "ProcessMd5": "81a7701a194c3a1179cfe4a7ac836626",
            "ProcessName": "runc",
            "ProcessParam": "cilium-agent --config-dir=/tmp/cilium/config-map",
            "ProcessPath": "/opt/containerd/bin/runc",
            "ProcessStartUser": "root",
            "ProcessTree": "runc(2743103)|containerd-shim-runc-v2(289436)|systemd(1)",
            "ProcessUserGroup": "root"
        },
        "RequestId": "c544fc31-7576-43aa-a4f3-b4c40656f67a"
    }
}

5. 开发者资源

腾讯云 API 平台

腾讯云 API 平台 是综合 API 文档、错误码、API Explorer 及 SDK 等资源的统一查询平台，方便您从同一入口查询及使用腾讯云提供的所有 API 服务。

API Inspector

用户可通过 API Inspector 查看控制台每一步操作关联的 API 调用情况，并自动生成各语言版本的 API 代码，也可前往 API Explorer 进行在线调试。

SDK

云 API 3.0 提供了配套的开发工具集（SDK），支持多种编程语言，能更方便的调用 API。

• Tencent Cloud SDK 3.0 for Python: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Java: GitHub, Gitee
• Tencent Cloud SDK 3.0 for PHP: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Go: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Node.js: GitHub, Gitee
• Tencent Cloud SDK 3.0 for .NET: GitHub, Gitee
• Tencent Cloud SDK 3.0 for C++: GitHub, Gitee
• Tencent Cloud SDK 3.0 for Ruby: GitHub, Gitee

命令行工具

• Tencent Cloud CLI 3.0

6. 错误码

以下仅列出了接口业务逻辑相关的错误码，其他错误码详见 公共错误码。