Set up Dynatrace OneAgent as a Docker container

This is the URL:

This is the token:

Replace the value of arch parameter with <arch>. Ignore the flavor=default parameter.

Your URL should look like this: https://host.domain.com/api/v1/deployment/installer/agent/unix/default/latest?arch=<arch>

This is your ONEAGENT_INSTALLER_SCRIPT_URL.

This your URL and API token.

Append the API token to the URL using the API-Token parameter. Your URL should look like this:

https://host.domain.com/api/v1/deployment/installer/agent/unix/default/latest?arch=x86&flavor=default&Api-Token=<token>

This is your ONEAGENT_INSTALLER_SCRIPT_URL.

Execute the following docker run command on all your Docker hosts, making sure that you pass the URL and token you determined earlier as the values of ONEAGENT_INSTALLER_SCRIPT_URL and ONEAGENT_INSTALLER_DOWNLOAD_TOKEN environment variables.

shellcopydownload
docker run -d
--restart=on-failure:5
--pid=host
--net=host
--cap-drop ALL
--cap-add CHOWN
--cap-add DAC_OVERRIDE
--cap-add DAC_READ_SEARCH
--cap-add FOWNER
--cap-add FSETID
--cap-add KILL
--cap-add NET_ADMIN
--cap-add NET_RAW
--cap-add SETFCAP
--cap-add SETGID
--cap-add SETUID
--cap-add SYS_ADMIN
--cap-add SYS_CHROOT
--cap-add SYS_PTRACE
--cap-add SYS_RESOURCE
--security-opt apparmor:unconfined
-v /:/mnt/root
-e ONEAGENT_INSTALLER_SCRIPT_URL=<REPLACE_WITH_YOUR_URL>
-e ONEAGENT_INSTALLER_DOWNLOAD_TOKEN=<Api-Token>
dynatrace/oneagent <INSTALLER_PARAMETERS>

1. Go to /etc/apparmor.d and create oneagent file with the following content:

plaintextcopydownload
#include <tunables/global>

@{INITIAL_HOST_ROOT}=/mnt/root
@{HOST_ROOT}=/mnt/host_root
@{DOCKER_VOLUME_PATH}=/mnt/root/var/lib/docker/volumes/dynatrace_oneagent_storage/_data
@{VOLUME_MOUNT}=/mnt/volume_storage_mount
@{INSTALL_PATH}=/opt/dynatrace/oneagent
@{CONFIG_PATH}=/var/lib/dynatrace/oneagent
@{LOG_PATH}=/var/log/dynatrace/oneagent

profile oneagent flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>
  #include <abstractions/dbus>

  network,
  file,

  capability chown,
  capability dac_override,
  capability dac_read_search,
  capability fowner,
  capability fsetid,
  capability kill,
  capability net_admin,
  capability net_raw,
  capability setfcap,
  capability setgid,
  capability setuid,
  capability sys_admin,
  capability sys_chroot,
  capability sys_ptrace,
  capability sys_resource,

  # Allow mounting volume paths to host root
  mount options=(rw, rbind) {@{VOLUME_MOUNT},@{DOCKER_VOLUME_PATH}}/opt/ -> @{HOST_ROOT}@{INSTALL_PATH}/,
  mount options=(rslave) -> @{HOST_ROOT}@{INSTALL_PATH}/,
  mount options=(rw, rbind) {@{VOLUME_MOUNT},@{DOCKER_VOLUME_PATH}}/var/ -> @{HOST_ROOT}@{CONFIG_PATH}/,
  mount options=(rslave) -> @{HOST_ROOT}@{CONFIG_PATH}/,
  mount options=(rw, rbind) {@{VOLUME_MOUNT},@{DOCKER_VOLUME_PATH}}/var_log/ -> @{HOST_ROOT}@{LOG_PATH}/,
  mount options=(rslave) -> @{HOST_ROOT}@{LOG_PATH}/,
  mount options=(rw, bind) /var_lib_helper/ -> @{HOST_ROOT}/var/lib/,
  mount options=(rw, bind) /var_log_helper/ -> @{HOST_ROOT}/var/log/,

  # Allow remounting host root to the new location
  mount options=(rw, rbind) @{INITIAL_HOST_ROOT}/**/ -> @{HOST_ROOT}/*/,
  mount options=(rw, bind) @{INITIAL_HOST_ROOT}/* -> @{HOST_ROOT}/*,
  mount options=(rw, bind) @{INITIAL_HOST_ROOT}/**/* -> @{HOST_ROOT}/*,
  mount options=(rslave) -> @{HOST_ROOT}/*/,
  mount options=(rw, rbind) @{INITIAL_HOST_ROOT}/**/ -> @{HOST_ROOT}/opt/*/,
  mount options=(rw, bind) @{INITIAL_HOST_ROOT}/**/* -> @{HOST_ROOT}/opt/*,
  mount options=(rslave) -> @{HOST_ROOT}/opt/*/,
  mount options=(rw, rbind) @{INITIAL_HOST_ROOT}/**/ -> @{HOST_ROOT}/var/lib/*/,
  mount options=(rw, bind) @{INITIAL_HOST_ROOT}/**/* -> @{HOST_ROOT}/var/lib/*,
  mount options=(rslave) -> @{HOST_ROOT}/var/lib/*/,
  mount options=(rw, rbind) @{INITIAL_HOST_ROOT}/**/ -> @{HOST_ROOT}/var/log/*/,
  mount options=(rw, bind) @{INITIAL_HOST_ROOT}/**/* -> @{HOST_ROOT}/var/log/*,
  mount options=(rslave) -> @{HOST_ROOT}/var/log/*/,
  mount options=(rw, rbind) @{INITIAL_HOST_ROOT}/sys/fs/cgroup/ -> @{HOST_ROOT}/sys/fs/cgroup/,
  mount options=(rw, rbind) /sys/fs/cgroup -> @{HOST_ROOT}/sys/fs/cgroup/,
  mount options=(rw) fstype=(proc) proc -> @{HOST_ROOT}/proc/,
  mount options=(rw) fstype=(sysfs) sys -> @{HOST_ROOT}/sys/,
  mount options=(rw) fstype=(securityfs) securityfs -> @{HOST_ROOT}/sys/kernel/security/,
  mount options=(rw) fstype=(selinuxfs) selinuxfs -> @{HOST_ROOT}/sys/fs/selinux/,
  mount options=(rw) fstype=(debugfs) debugfs -> @{HOST_ROOT}/sys/kernel/debug/,
  umount @{INITIAL_HOST_ROOT}/,

  # Allow unmounting problematic mounts
  umount @{HOST_ROOT}/var/lib/docker/aufs/,
  umount @{HOST_ROOT}/var/lib/docker/devicemapper/,
  umount @{HOST_ROOT}/var/lib/kubelet/plugins/kubernetes.io/csi/pv/pvc-*/globalmount/,
  umount @{HOST_ROOT}/var/lib/kubelet/pods/*/volumes/kubernetes.io~{downward-api,empty-dir,csi,secret}/**,
  umount @{HOST_ROOT}/var/lib/kubelet/pods/*/volume-subpaths/**,
  umount @{HOST_ROOT}/run/netns/**,
  umount @{HOST_ROOT}/run/containerd/io.containerd.grpc.v1.cri/sandboxes/**,

  # Host (privileged) processes may send signals to container processes.
  signal (receive) peer=unconfined,

  # Container processes may send signals amongst themselves.
  signal (send,receive) peer=@{profile_name},

  deny @{PROC}/* w,
  deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9/]*}/** w,
  deny @{PROC}/sys/[^k]** w,
  deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w,
  deny @{PROC}/sysrq-trigger rwklx,
  deny @{PROC}/kcore rwklx,
  deny /sys/[^f]*/** wklx,
  deny /sys/f[^s]*/** wklx,
  deny /sys/fs/[^c]*/** wklx,
  deny /sys/fs/c[^g]*/** wklx,
  deny /sys/fs/cg[^r]*/** wklx,
  deny /sys/firmware/** rwklx,
  deny /sys/kernel/security/** rwklx,

  ptrace,

  @{HOST_ROOT}@{INSTALL_PATH}/agent/lib64/oneagenthelper Cx,
  profile @{HOST_ROOT}@{INSTALL_PATH}/agent/lib64/oneagenthelper flags=(attach_disconnected,mediate_deleted,chroot_relative) {
    #include <abstractions/base>
    #include <abstractions/dbus>

    network,
    file,

    capability dac_override,
    capability fowner,
    capability fsetid,
    capability sys_admin,
    capability sys_chroot,
    capability sys_ptrace,

    # Allow mounting paths needed for container injection
    mount options=(rw, rbind) @{INSTALL_PATH}/ -> /**/,
    mount options=(rw, rbind) @{CONFIG_PATH}/agent/ -> /**/,
    mount options=(rw, rbind) @{CONFIG_PATH}/datastorage/ -> /**/,
    mount options=(rw, rbind) @{CONFIG_PATH}/agent/config/container.conf* -> /**,
    mount options=(rw, rbind) @{CONFIG_PATH}/agent/runtime/.container.conf* -> /**,
    mount options=(rw, rbind) @{CONFIG_PATH}/agent/config/ld.so.preload* -> /**,
    mount options=(rw, rbind) @{CONFIG_PATH}/agent/runtime/.ld.so.preload* -> /**,
    mount options=(rw, rbind) @{LOG_PATH}/ -> /**/,
    mount options=(slave) -> /**,
    mount options=(ro, remount, bind) -> /**,

    ptrace,
  }
}

2. Run the following command to load the AppArmor profile:

shellcopydownload
apparmor_parser -r /etc/apparmor.d/oneagent

3. Execute the following docker run command on all your Docker hosts, making sure that you pass the URL and token you determined earlier as the values of ONEAGENT_INSTALLER_SCRIPT_URL and ONEAGENT_INSTALLER_DOWNLOAD_TOKEN environment variables.

shellcopydownload
docker run -d
--restart=on-failure:5
--pid=host
--net=host
--cap-drop ALL
--cap-add CHOWN
--cap-add DAC_OVERRIDE
--cap-add DAC_READ_SEARCH
--cap-add FOWNER
--cap-add FSETID
--cap-add KILL
--cap-add NET_ADMIN
--cap-add NET_RAW
--cap-add SETFCAP
--cap-add SETGID
--cap-add SETUID
--cap-add SYS_ADMIN
--cap-add SYS_CHROOT
--cap-add SYS_PTRACE
--cap-add SYS_RESOURCE
--security-opt apparmor:oneagent
-v /:/mnt/root
-e ONEAGENT_INSTALLER_SCRIPT_URL=<REPLACE_WITH_YOUR_URL>
-e ONEAGENT_INSTALLER_DOWNLOAD_TOKEN=<Api-Token>
dynatrace/oneagent <INSTALLER_PARAMETERS>

Note: Once the container is started, a regular OneAgent full-stack installer is executed and OneAgent files are deployed to the underlying file system of the machine running the container. The installation package and associated shell script are downloaded from your environment upon container startup, using the URL provided for launching the container. The signature of the installer is verified automatically following the download. After you succesfully started the container, the status will be marked as healthy.

shellcopydownload
$ docker ps
CONTAINER ID   IMAGE                COMMAND                  CREATED         STATUS                   PORTS     NAMES
e3e1e513f0ff   dynatrace/oneagent   "/bin/bash /tmp/entr…"   2 minutes ago   Up 2 minutes (healthy)             stupefied_elgamal