Monitor containers and underlying hosts: CoreOS

The Linux agent for New Relic Infrastructure supports CoreOS via a container that can monitor metrics for the container itself, as well as the underlying host. Using the custom (recommended) or simple setup allows the New Relic Infrastructure agent to run inside a container environment, which has the ability to monitor the host it's running on.

A host can only be running one instance of the agent at a time, whether that's the containerized agent or the non-containerized version.

The New Relic agent monitors containers from the host-level. The containerized agent should be used if you're running a containerOS or have security restrictions that require deploying the agent as a container.

Custom setup (recommended)

The following are basic instructions for creating a custom Docker Image on Linux, which allows you to deploy the Infrastructure agent as a container that will monitor its underlying host. New Relic recommends extending the newrelic/infrastructure image (hosted on DockerHub) and providing your own newrelic-infra.yml agent config file.

New Relic recommends a custom setup, because it allows you to provide your own agent config file. Once your image is built, you can easily spin up a container without having to provide more launch time configurations.

Providing secrets via environment variables with Docker is discouraged.

  1. Create your newrelic-infra.yml agent config file:

    license_key: YOUR_LICENSE_KEY

  2. Create your Dockerfile extending the newrelic/infrastructure image and add your config to /etc/newrelic-infra.yml:

    FROM newrelic/infrastructure:latest
ADD newrelic-infra.yml /etc/newrelic-infra.yml

  3. Build and tag your image:

    docker build -t YOUR_IMAGE_NAME .

  4. Run the container from the image you built with the required required run flags:

    docker run \
    -d \
    --name newrelic-infra \
    --network=host \
    --cap-add=SYS_PTRACE \
    -v "/:/host:ro" \
    -v "/var/run/docker.sock:/var/run/docker.sock" \
    YOUR_IMAGE_NAME

Simple setup

To use the simple setup with a base New Relic Infrastructure image:

  1. Run the container with the required run flags:

    docker run \
   -d \
   --name newrelic-infra \
   --network=host \
   --cap-add=SYS_PTRACE \
   -v "/:/host:ro" \
   -v "/var/run/docker.sock:/var/run/docker.sock" \
   -e NRIA_LICENSE_KEY=YOUR_LICENSE_KEY \
   newrelic/infrastructure:latest

Required container privileges

Due to resource isolation from the host and other containers via Linux namespaces, a container has a very restricted view and control of its underlying host's resources by default. Without these extra privileges, the Infrastructure agent cannot monitor the host and its containers.

The Infrastructure agent collects data about its host using system files and system calls. For more information about how the Infrastructure agent collects data, see Infrastructure and security.

Required privileges include:

Privilege Description
--network=host

Sets the container's network namespace to the host's network namespace. This allows the agent to collect the network metrics about the host.
-v "/:/host:ro"

Bind mounts the host's root volume to the container. This read-only access to the host's root allows the agent to collect process and storage metrics as well as Inventory data from the host.
--cap-add=SYS_PTRACE

Adds the linux capability to trace system processes. This allows the agent to gather data about processes running on the host. Read more here.
-v "/var/run/docker.sock:/var/run/docker.sock"

Bind mounts the host's Docker daemon socket to the container. This allows the agent to connect to the Engine API via the Docker daemon socket to collect the host's container data.

Inventory collected

Inventory is collected from the Infrastructure agent's built-in data collectors. The Infrastructure agent collects this data for Linux systems running with containers.

Category Source Data collected using...
metadata agent_config Agent's complete config file
system uptime -s, /etc/redhat-release, /proc/cpuinfo, /etc/os-release, /proc/sys/kernel/random/boot_id, /proc/sys/kernel/osrelease, /sys/class/dmi/id/product_uuid, /sys/devices/virtual/dmi/id/sys_vendor, /sys/devices/virtual/dmi/id/product_name

CoreOS data

Once the Infrastructure agent is running in a Docker container, it can collect the same host compute data and event data that the Infrastructure agent is capable of collecting when running natively on a host.

Containerized agent image

Containerized agent image is built from an Alpine base image, but a Centos based image is also available.

Since version 0.0.55 Alpine is used as the base image. This is the one pointed by latest tag.

Prior versions used Centos7 as base image. In order to keep using that legacy image some backports might be included there, you can point to latest-centos tag to fetch latest Centos7 based image.

For more help

Recommendations for learning more: