How jonscafe/cglime works
cglime acquires physical pages belonging to a selected container or Kubernetes pod, rather than dumping all host RAM. The documented workflow is to identify and freeze the target, acquire a LiME dump, verify it, and create an evidence package. Acquisition includes regular and slab-page attribution, compound-page handling, and an independent kpagecgroup path; analysis tools add scoped process and memory checks. README and source-index references support the shown relationships, but several orchestration and evidence-package internals were not excerpted, so those connections are left unasserted.
Main entry points: memcg_scan.py Memcg scan · cgroupres.py Cgroup resolution · pslist_scoped.py Scoped process list · slab_probe.py Slab attribution
Components 27
Acquisition
- Command interface
cglime.py - LiME writer
limefmt.py - Page-table acquisition
acquire.py - kpagecgroup path
kpagecg.py - Hybrid dump
hybrid_dump.py
Attribution
- Cgroup resolution
cgroupres.py - Physical reader
ebpf/rawbpf.py - Memcg scan
memcg_scan.py - Slab attribution
slab_probe.py - Slab geometry
slabgeom.py - Compound pages
folio.py - Kernel semantics
kernelgate.py
Validation
- Kernel calibration
calibrate.py - Coverage checks
envelope.py - Host probe
probe_host.py - Compound probe
compound_probe.py - Memcg probe
memcg_probe.py - Spot checks
spotcheck.py - Dump analyzability
analyzability.py
Live analysis
- Swap accounting
zswap.py - Scoped process list
pslist_scoped.py - BTF reader
btf.py
Evidence
- Capture sidecars
sidecar.py - Evidence package
evidence.py - Capture bundle
bundle.py
Other components
- Operator
- Container or pod
Connections 43
- Operator → Command interface: runs commands
README.md - Container or pod → Command interface: supplies identifier
README.md - Command interface → Page-table acquisition: dispatches acquisition
- Command interface → Evidence package: dispatches packaging
- Page-table acquisition → Cgroup resolution: resolves target
acquire.py - Page-table acquisition → Compound pages: uses page geometry
acquire.py - Page-table acquisition → Kernel semantics: checks kernel semantics
acquire.py - Page-table acquisition → LiME writer: writes LiME
acquire.py - Memcg scan → Cgroup resolution: resolves cgroups
memcg_scan.py - Memcg scan → Physical reader: reads physical memory
memcg_scan.py - Memcg scan → Compound pages: handles compound pages
memcg_scan.py - Memcg scan → Slab geometry: reads slab geometry
memcg_scan.py - Memcg scan → Kernel calibration: uses calibration
memcg_scan.py - Memcg scan → Kernel semantics: checks kernel semantics
memcg_scan.py - Memcg scan → Coverage checks: checks coverage
memcg_scan.py - Memcg scan → Swap accounting: accounts swap
memcg_scan.py - Memcg scan → Capture sidecars: writes sidecars
memcg_scan.py - Slab attribution → Cgroup resolution: resolves target
slab_probe.py - Slab attribution → Physical reader: reads physical memory
slab_probe.py - Slab attribution → Compound pages: handles compound pages
slab_probe.py - Slab attribution → Slab geometry: reads slab geometry
slab_probe.py - Slab attribution → Kernel semantics: checks kernel semantics
slab_probe.py - kpagecgroup path → Cgroup resolution: resolves target
kpagecg.py - kpagecgroup path → Coverage checks: checks coverage
kpagecg.py - Hybrid dump → Cgroup resolution: resolves target
hybrid_dump.py - Hybrid dump → Physical reader: reads physical memory
hybrid_dump.py - Kernel calibration → Compound pages: calibrates constants
calibrate.py - Host probe → Kernel semantics: checks kernel support
probe_host.py - Compound probe → Cgroup resolution: resolves target
compound_probe.py - Compound probe → Compound pages: tests compound pages
compound_probe.py - Compound probe → Physical reader: reads physical memory
compound_probe.py - Memcg probe → Cgroup resolution: resolves target
memcg_probe.py - Memcg probe → Compound pages: uses page geometry
memcg_probe.py - Memcg probe → Physical reader: reads physical memory
memcg_probe.py - Scoped process list → BTF reader: reads kernel types
pslist_scoped.py - Scoped process list → Cgroup resolution: resolves target
pslist_scoped.py - Scoped process list → Physical reader: reads physical memory
pslist_scoped.py - Scoped process list → Slab attribution: uses slab attribution
pslist_scoped.py - Scoped process list → Slab geometry: reads slab geometry
pslist_scoped.py - Scoped process list → Kernel semantics: checks kernel semantics
pslist_scoped.py - Swap accounting → Cgroup resolution: resolves target
zswap.py - kpagecgroup path → Coverage checks: checks captured totals
kpagecg.py - Operator → Evidence package: requests package
README.md