Why Is "No access to perf events" Displayed?

Symptom

CPU Profiler depends on the perf_event_open system call. However, due to the Syscall security policy (seccomp) control of the Linux kernel, processes may be prohibited from calling specific Syscalls.

Error message:

[ERROR] xxxx Failed to execute 'start,jfr=7,jstackdepth=100,threads=true,event=cpu,interval=50ms,alloc=512k,wall=50ms,file=xxxx.jfr'
[ERROR] xxxx Failed to start Continuous Profile Collector
[ERROR] xxxx No access to perf events. Try --fdtransfer or --all-user option or 'sysctl kernel.perf_event_paranoid=1'

Solution

• Docker environment: Run the following command to run the container. To configure fine-grained system call control, see the official document. Enabling privileged containers may cause container escape. Please exercise cautions.

    docker run --security-opt seccomp=unconfined  XXX

• Kubernetes environment: Set privileged to true for a privileged container. The privileged container is always in the Unconfined state. If privileged cannot be set to true, you can modify securityContext in the Kubernetes YAML file to use the default system call control. For details, see the official document. Enabling privileged containers may cause container escape. Please exercise cautions.

  apiVersion: v1
  kind: Pod
  metadata:
    name: default-pod
    labels:
      app: default-pod
  spec:
    containers:
      - name: test-container
        image: hashicorp/http-echo:1.0
        args:
          - "-text=just made some more syscalls!"
        securityContext:
          seccompProfile:
            type: RuntimeDefault
          capabilities:
            add: [ "SYS_ADMIN" ]
          privileged: false