Docker Container

Prerequisites

• A Linux host with supported kernel (5.10+)

• Docker. For installation instructions, refer to the Docker official documentation.

• (For cloud-connected mode) Registration Token: Valid registration token from app.qpoint.io

• (For local mode) Configuration Files: Prepare your Qtap YAML config file

Installation Steps

Download the Docker Image:

docker pull us-docker.pkg.dev/qpoint-edge/public/qpoint:v0

Running Qtap in Docker

Cloud-Connected Mode

To run Qtap in cloud-connected mode, use the following command:

docker run \
  --user 0:0 \
  --privileged \
  --cap-add CAP_BPF \
  --cap-add CAP_SYS_ADMIN \
  --pid=host \
  --network=host \
  -v /sys:/sys \
  -e TINI_SUBREAPER=1 \
  --ulimit=memlock=-1 \
  us-docker.pkg.dev/qpoint-edge/public/qpoint:v0 \
  tap \
  --log-level=info \
  --log-encoding=console \
  --registration-token=$TOKEN

Replace $TOKEN with your actual registration token obtained from app.qpoint.io.

Local Mode

To run Qtap in local mode, use the following command:

docker run \
  --user 0:0 \
  --privileged \
  --cap-add CAP_BPF \
  --cap-add CAP_SYS_ADMIN \
  --pid=host \
  --network=host \
  -v /sys:/sys \
  -v "$(pwd):/app/config" \
  -e TINI_SUBREAPER=1 \
  --ulimit=memlock=-1 \
  us-docker.pkg.dev/qpoint-edge/public/qpoint:v0 \
  tap \
  --log-level=info \
  --log-encoding=console \
  --qpoint-config=/app/config/qpoint.yaml

Replace /app/config/qpoint.yaml with the actual path to your YAML configuration file inside the container. Make sure to mount your local configuration file to this path using the -v option.

Docker Run Command Options Explained

1. --user 0:0: Runs the container as root (necessary for eBPF operations).

2. --privileged: Gives extended privileges to this container.

3. --cap-add CAP_BPF: Adds the CAP_BPF capability (required for eBPF operations).

4. --cap-add CAP_SYS_ADMIN: Adds the CAP_SYS_ADMIN capability (for low-level system operations).

5. --pid=host: Shares the host's PID namespace with the container.

6. --network=host: Uses the host's network stack inside the container.

7. -v /sys:/sys: Mounts the host's /sys directory into the container.

8. -v "$(pwd):/app/config": Mounts the current directory to /app/config in the container.

9. -e TINI_SUBREAPER=1: Sets up Tini as a subreaper for proper signal handling.

10. --ulimit=memlock=-1: Removes the memory lock limit for eBPF programs.

Qtap-specific Flags

• --log-level=info: Sets the logging level.

• --log-encoding=console: Sets the log encoding format.

• --registration-token=$TOKEN: (Cloud-connected mode) Provides the registration token for Qtap.

• --qpoint-config=/app/config/qpoint.yaml: (Local mode) Specifies the path to the Qtap configuration file.

Available Flags and Options

To see all available options and flags, run:

docker run --rm us-docker.pkg.dev/qpoint-edge/public/qpoint:v0 tap --help