eBPF and Container Runtimes: Connecting via the CRI

This article explores how open-source eBPF projects connect with container runtimes (CRs) using the Container Runtime Interface (CRI) to enrich context with pod and container information. It details the connection process: locating the Unix socket file, establishing a gRPC connection using the CRI API, and querying information. Examples from Tetragon, crictl, and Tracee illustrate different approaches to connecting to the CR, including hardcoded default socket paths and runtime connection attempts. Finally, it demonstrates querying container information like cgroup paths using the CRI API, such as Tetragon's method for retrieving a container's cgroup path.