cAdvisor (Container Advisor) is an open-source container resource usage and performance analysis tool developed by Google. It provides container users an understanding of the resource usage and performance characteristics of their running containers.
| File/Directory | Path | Purpose |
|---|---|---|
| Binary | /usr/bin/cadvisor |
cAdvisor executable |
| Systemd service | /etc/systemd/system/cadvisor.service |
Service definition |
| Environment | /etc/default/cadvisor |
Environment variables |
| Storage | /var/lib/cadvisor/ |
cAdvisor data storage |
| Logs | /var/log/cadvisor/ |
cAdvisor log files |
| TLS certificates | /etc/cadvisor/ssl/ |
TLS/SSL certificates |
| Docker socket | /var/run/docker.sock |
Docker daemon socket |
| Containerd socket | /run/containerd/containerd.sock |
Containerd socket |
| CRI-O socket | /var/run/crio/crio.sock |
CRI-O socket |
# cAdvisor command-line options
# Basic options
cadvisor \
--listen_ip="0.0.0.0" \
--port=8080 \
--hostname_override="" \
--docker="" \
--docker_only=false \
--raw_cgroup_prefix="" \
--disable_metrics="" \
--enable_metrics="" \
--store_container_labels=true \
--allowed_metrics="" \
--denied_metrics=""
# Storage options
cadvisor \
--storage_driver="" \
--storage_driver_host="" \
--storage_driver_db="" \
--storage_driver_user="" \
--storage_driver_password="" \
--storage_driver_secure=false \
--storage_driver_buffer_duration=60s
# Resource options
cadvisor \
--housekeeping_interval=1s \
--max_housekeeping_interval=60s \
--event_storage_event_limit=100000 \
--event_storage_age_limit=24h
# Security options
cadvisor \
--auth="" \
--auth_config="" \
--ssl_cert_file="" \
--ssl_key_file="" \
--ssl_ca_cert_file=""
# Logging options
cadvisor \
--logtostderr=true \
--alsologtostderr=false \
--log_backtrace_at=:0 \
--log_dir="" \
--log_file="" \
--log_file_max_size=1800 \
--log_file_max_files=1 \
--one_output=false \
--skip_headers=false \
--skip_log_headers=false \
--stderrthreshold=2 \
--v=1 \
--vmodule=
# Prometheus options
cadvisor \
--prometheus_endpoint="/metrics" \
--disable_root_cgroup_stats=false
# /etc/systemd/system/cadvisor.service
[Unit]
Description=cAdvisor - Container Advisor
Documentation=https://github.com/google/cadvisor
After=docker.service containerd.service crio.service
Wants=docker.service containerd.service crio.service
ConditionPathExists=/var/run/docker.sock
[Service]
Type=notify
NotifyAccess=main
EnvironmentFile=-/etc/default/cadvisor
ExecStart=/usr/bin/cadvisor \
--listen_ip=0.0.0.0 \
--port=8080 \
--housekeeping_interval=1s \
--max_housekeeping_interval=60s \
--event_storage_event_limit=100000 \
--event_storage_age_limit=24h \
--docker_only=false \
--store_container_labels=true \
--disable_metrics="" \
--enable_metrics="" \
--storage_driver="" \
--logtostderr=true \
--alsologtostderr=false \
--v=2
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=5
LimitNOFILE=1048576
# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/cadvisor /var/log/cadvisor
PrivateTmp=true
[Install]
WantedBy=multi-user.target
# /etc/default/cadvisor
# cAdvisor listening configuration
CADVISOR_LISTEN_IP=0.0.0.0
CADVISOR_PORT=8080
# Hostname override (for containerized cAdvisor)
CADVISOR_HOSTNAME_OVERRIDE=
# Docker configuration
CADVISOR_DOCKER=
CADVISOR_DOCKER_ONLY=false
# Container runtime configuration
CADVISOR_CONTAINERD=/run/containerd/containerd.sock
CADVISOR_CRIO=/var/run/crio/crio.sock
# Metrics configuration
CADVISOR_DISABLE_METRICS=
CADVISOR_ENABLE_METRICS=
CADVISOR_ALLOWED_METRICS=
CADVISOR_DENIED_METRICS=
# Storage configuration
CADVISOR_STORAGE_DRIVER=
CADVISOR_STORAGE_DRIVER_HOST=
CADVISOR_STORAGE_DRIVER_DB=
CADVISOR_STORAGE_DRIVER_USER=
CADVISOR_STORAGE_DRIVER_PASSWORD=
CADVISOR_STORAGE_DRIVER_SECURE=false
CADVISOR_STORAGE_DRIVER_BUFFER_DURATION=60s
# Housekeeping configuration
CADVISOR_HOUSEKEEPING_INTERVAL=1s
CADVISOR_MAX_HOUSEKEEPING_INTERVAL=60s
CADVISOR_EVENT_STORAGE_EVENT_LIMIT=100000
CADVISOR_EVENT_STORAGE_AGE_LIMIT=24h
# Security configuration
CADVISOR_AUTH=
CADVISOR_AUTH_CONFIG=
CADVISOR_SSL_CERT_FILE=
CADVISOR_SSL_KEY_FILE=
CADVISOR_SSL_CA_CERT_FILE=
# Logging configuration
CADVISOR_LOG_TO_STDERR=true
CADVISOR_ALSO_LOG_TO_STDERR=false
CADVISOR_LOG_DIR=
CADVISOR_LOG_FILE=
CADVISOR_LOG_FILE_MAX_SIZE=1800
CADVISOR_LOG_FILE_MAX_FILES=1
CADVISOR_V=2
CADVISOR_VMODULE=
# Container labels
CADVISOR_STORE_CONTAINER_LABELS=true
CADVISOR_LABEL_WHITELIST=
# Raw cgroup prefix
CADVISOR_RAW_CGROUP_PREFIX=
# Root cgroup stats
CADVISOR_DISABLE_ROOT_CGROUP_STATS=false
# Prometheus endpoint
CADVISOR_PROMETHEUS_ENDPOINT=/metrics
# Run cAdvisor with Docker integration
docker run \
--volume=/:/rootfs:ro \
--volume=/var/run:/var/run:ro \
--volume=/sys:/sys:ro \
--volume=/var/lib/docker/:/var/lib/docker:ro \
--volume=/dev/disk/:/dev/disk:ro \
--publish=8080:8080 \
--detach=true \
--name=cadvisor \
--privileged \
--device=/dev/kmsg \
gcr.io/cadvisor/cadvisor:latest \
--housekeeping_interval=1s \
--docker_only=false \
--store_container_labels=true \
--disable_metrics="" \
--enable_metrics="tcp,udp"
# Run cAdvisor with containerd integration
cadvisor \
--containerd=/run/containerd/containerd.sock \
--containerd_namespace=k8s.io \
--housekeeping_interval=1s
# Run cAdvisor with CRI-O integration
cadvisor \
--crio=/var/run/crio/crio.sock \
--housekeeping_interval=1s
# Run cAdvisor in Kubernetes (as DaemonSet)
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: cadvisor
namespace: monitoring
labels:
app: cadvisor
spec:
selector:
matchLabels:
app: cadvisor
template:
metadata:
labels:
app: cadvisor
annotations:
prometheus.io/scrape: "true"
prometheus.io/port: "8080"
spec:
serviceAccountName: cadvisor
containers:
- name: cadvisor
image: gcr.io/cadvisor/cadvisor:latest
args:
- --housekeeping_interval=1s
- --docker_only=false
- --store_container_labels=true
- --disable_metrics=""
- --enable_metrics="tcp,udp"
ports:
- name: http
containerPort: 8080
protocol: TCP
resources:
requests:
cpu: 100m
memory: 200Mi
limits:
cpu: 500m
memory: 500Mi
volumeMounts:
- name: rootfs
mountPath: /rootfs
readOnly: true
- name: var-run
mountPath: /var/run
readOnly: true
- name: sys
mountPath: /sys
readOnly: true
- name: docker
mountPath: /var/lib/docker
readOnly: true
- name: disk
mountPath: /dev/disk
readOnly: true
volumes:
- name: rootfs
hostPath:
path: /
- name: var-run
hostPath:
path: /var/run
- name: sys
hostPath:
path: /sys
- name: docker
hostPath:
path: /var/lib/docker
- name: disk
hostPath:
path: /dev/disk
nodeSelector:
kubernetes.io/os: linux
# Enable specific metrics
cadvisor \
--enable_metrics="tcp,udp,hugetlb,memory_numa,process_scheduler,percpu" \
--disable_metrics=""
# Disable specific metrics
cadvisor \
--disable_metrics="tcp,udp" \
--enable_metrics=""
# Allow only specific metrics
cadvisor \
--allowed_metrics="cpu,memory,network,disk"
# Deny specific metrics
cadvisor \
--denied_metrics="hugetlb,memory_numa"
# In-memory storage (default)
cadvisor --storage_driver=""
# BigQuery storage
cadvisor \
--storage_driver="bigquery" \
--storage_driver_host="bigquery.google.com" \
--storage_driver_db="your_project" \
--storage_driver_user="your_email" \
--storage_driver_password="your_password"
# Elasticsearch storage
cadvisor \
--storage_driver="elasticsearch" \
--storage_driver_host="http://elasticsearch:9200" \
--storage_driver_db="cadvisor"
# InfluxDB storage
cadvisor \
--storage_driver="influxdb" \
--storage_driver_host="http://influxdb:8086" \
--storage_driver_db="cadvisor" \
--storage_driver_user="cadvisor" \
--storage_driver_password="password" \
--storage_driver_secure=false
# Kafka storage
cadvisor \
--storage_driver="kafka" \
--storage_driver_host="kafka:9092" \
--storage_driver_db="cadvisor"
# Prometheus remote write storage
cadvisor \
--storage_driver="prometheus" \
--storage_driver_host="http://prometheus:9090" \
--storage_driver_db="cadvisor"
# Redis storage
cadvisor \
--storage_driver="redis" \
--storage_driver_host="redis:6379" \
--storage_driver_db="0" \
--storage_driver_password=""
# SQL storage (MySQL/PostgreSQL)
cadvisor \
--storage_driver="sql" \
--storage_driver_host="mysql:3306" \
--storage_driver_db="cadvisor" \
--storage_driver_user="cadvisor" \
--storage_driver_password="password"
# Generate self-signed certificates
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout /etc/cadvisor/ssl/cadvisor.key \
-out /etc/cadvisor/ssl/cadvisor.crt \
-subj "/CN=cadvisor.example.com"
# Run cAdvisor with TLS
cadvisor \
--ssl_cert_file=/etc/cadvisor/ssl/cadvisor.crt \
--ssl_key_file=/etc/cadvisor/ssl/cadvisor.key \
--ssl_ca_cert_file=/etc/cadvisor/ssl/ca.crt \
--listen_ip=0.0.0.0 \
--port=8080
# Create htpasswd file
htpasswd -cb /etc/cadvisor/auth.htpasswd admin AdminPassword123!
# Run cAdvisor with basic auth
cadvisor \
--auth="basic" \
--auth_config="/etc/cadvisor/auth.htpasswd"
# /etc/systemd/system/cadvisor.service (security additions)
[Service]
# Additional security hardening
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_NET_ADMIN CAP_NET_RAW
AmbientCapabilities=
SystemCallFilter=@system-service
SystemCallArchitectures=native
MemoryDenyWriteExecute=true
LockPersonality=true
RestrictRealtime=true
RestrictSUIDSGID=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictNamespaces=true
PrivateDevices=true
ProtectClock=true
ProtectKernelLogs=true
ProtectHostname=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
NoNewPrivileges=true
# Check cAdvisor version
cadvisor --version
# Test configuration
cadvisor --help
# Check if cAdvisor can access Docker
docker ps
# Verify cAdvisor is collecting metrics
curl http://localhost:8080/metrics | head -50
# Restart cAdvisor service
sudo systemctl restart cadvisor
# Check service status
sudo systemctl status cadvisor
# View logs
sudo journalctl -u cadvisor -f
# Reload configuration
sudo systemctl reload cadvisor
# Restart cAdvisor container
docker restart cadvisor
# View container logs
docker logs cadvisor
# Check container status
docker ps | grep cadvisor
# Check service status
sudo systemctl status cadvisor
# Check if listening
sudo netstat -tlnp | grep 8080
# Check running processes
ps aux | grep cadvisor
# Access web UI
curl http://localhost:8080
# Get metrics endpoint
curl http://localhost:8080/metrics
# Get container info
curl http://localhost:8080/api/v2.0/containers/
# Get specific container stats
curl http://localhost:8080/api/v2.0/containers/docker/<container_id>
# Get machine info
curl http://localhost:8080/api/v2.0/machine
# List containers being monitored
curl http://localhost:8080/api/v2.0/containers/ | jq '.[].name'
# Get container stats
curl http://localhost:8080/api/v2.0/containers/docker/ | jq '.'
# Check container labels
curl http://localhost:8080/api/v2.0/containers/ | jq '.[].spec.labels'
# Check Prometheus metrics
curl http://localhost:8080/metrics | grep "^container_"
# Verify metric labels
curl http://localhost:8080/metrics | grep "^container_cpu_usage_seconds_total"
# Check metric count
curl http://localhost:8080/metrics | grep -c "^container_"
Squeezing every bit of performance from your cAdvisor installation? Our experts help with:
Optimize your setup: office@linux-server-admin.com | Contact Us