EC2上のSysdigエージェントをプロキシ環境で動作させるには

2025-02-07 05:12:27.973, 10123.10158, Warning, endpoint:cm_collector_endpoint:872: Connection attempt failed. Retrying...
2025-02-07 05:12:29.041, 10123.10369, Error, cm_socket:1444: ＜今回の環境固有のエラーメッセージ＞

# docker exec ＜SysdigエージェントのコンテナID＞ env
＜中略＞
HTTPS_PROXY=<プロキシURL>
https_proxy=<プロキシURL>
HTTP_PROXY=<プロキシURL>
http_proxy=<プロキシURL>
HOME=/root
＜以下略＞

collector_port: 6443
http_proxy:
  proxy_host: $PROXY_HOST
  proxy_port: $PROXY_PORT

#!/bin/bash
set -ex
SYSDIG_COLLECTOR_DOMAIN=""
SYSDIG_SECURE_ENDPOINT_DOMAIN=""
SYSDIG_SECURE_ENDPOINT_URL="https://$SYSDIG_SECURE_ENDPOINT_DOMAIN"
SYSDIG_AGENT_TAG=""
PROXY_HOST=""
PROXY_PORT=""
SYSDIG_CONFIG_DIR=""

# env for proxy setting
echo "env for proxy setting"
export HTTP_PROXY="http://$PROXY_HOST:$PROXY_PORT"
export HTTPS_PROXY="http://$PROXY_HOST:$PROXY_PORT"

# OS環境変数設定（ユーザーセッション）
tee -a /etc/environment << EOF
HTTP_PROXY="http://$PROXY_HOST:$PROXY_PORT"
HTTPS_PROXY="http://$PROXY_HOST:$PROXY_PORT"
EOF

# ロックが解除されるまで待機するfunction
wait_for_apt_locks() {
    while fuser /var/lib/dpkg/lock >/dev/null 2>&1 || fuser /var/lib/apt/lists/lock >/dev/null 2>&1 || fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do
        echo "Waiting for other software managers to finish..."
        sleep 5
    done
}

# Add Docker's official GPG key:
sudo apt-get update
wait_for_apt_locks
sudo apt-get install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
wait_for_apt_locks
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# docker daemon設定
sudo mkdir -p /etc/systemd/system/docker.service.d
tee /etc/systemd/system/docker.service.d/http-proxy.conf << EOF
[Service]
Environment="HTTP_PROXY=http://$PROXY_HOST:$PROXY_PORT"
Environment="HTTPS_PROXY=http://$PROXY_HOST:$PROXY_PORT"
EOF

sudo systemctl daemon-reload
sudo systemctl restart docker

# docker build時のプロキシ設定
sudo mkdir -p ~/.docker
tee -a ~/.docker/config.json << EOF
{
    "proxies": {
        "default": {
            "httpProxy": "http://$PROXY_HOST:$PROXY_PORT",
            "httpsProxy": "http://$PROXY_HOST:$PROXY_PORT"
        }
    }
}
EOF

# Sysdig エージェントのプロキシ設定
sudo mkdir -p $SYSDIG_CONFIG_DIR
tee -a $SYSDIG_CONFIG_DIR/dragent.yaml << EOF
customerid: ${sysdig_agent_accesskey}
tags: $SYSDIG_AGENT_TAG
collector: $SYSDIG_COLLECTOR_DOMAIN
ssl: true
collector_port: 6443
http_proxy:
  proxy_host: $PROXY_HOST
  proxy_port: $PROXY_PORT
EOF

# sysdigエージェント起動&常駐化
docker run -d --name sysdig-agent --restart always --privileged --net host --pid host \
    -v $SYSDIG_CONFIG_DIR/dragent.yaml:/opt/draios/etc/dragent.yaml \
    -e ACCESS_KEY=${sysdig_agent_accesskey} \
    -e COLLECTOR=$SYSDIG_COLLECTOR_DOMAIN \
    -e SECURE=true \
    -v /var/run/docker.sock:/host/var/run/docker.sock \
    -v /dev:/host/dev \
    -v /proc:/host/proc:ro \
    -v /boot:/host/boot:ro \
    -v /lib/modules:/host/lib/modules:ro \
    -v /usr:/host/usr:ro \
    -v /etc:/host/etc:ro \
    --shm-size=512m \
    quay.io/sysdig/agent