resources

// The processor and memory each running container of a Docker host uses, by SSH, and the number of its
// processes. One command, docker stats --no-stream, which reads the figures once and returns: through
// sudo -n in the one form the sudoers line of the documentation allows, or straight when the account is in
// the docker group. Docker waits up to two seconds for a reading of each container before it answers.
// The processor is counted as Docker counts it, 100 % being one processor: a container busy on four
// processors reads 400 %. The memory is a share of the limit Docker gives the container, the figure that
// MemUsage writes after its slash.
need('protocol:ssh');
$sudo = variable('docker:sudo', 'boolean', array(
    'label'   => 'Through sudo',
    'help'    => 'Runs docker through sudo, with the sudoers line of the documentation. Off when the account is in the docker group instead.',
    'default' => true,
));

per('container', 'Containers');
output('cpu', 'number', array('label' => 'Processor in use', 'unit' => '%', 'per' => 'container'));
output('memory', 'number', array('label' => 'Memory in use', 'unit' => '%', 'per' => 'container'));
output('processes', 'number', array('label' => 'Processes', 'per' => 'container'));

watch.above('memory', 'Memory near its limit', 'memory', array('warning' => 90, 'critical' => 95, 'for' => '3 runs'));
watch.above('cpu', 'Processor busy', 'cpu', array(
    'help'    => 'The threshold depends on the number of processors a container may use: 100 % is one.',
    'enabled' => false,
));
watch.above('processes', 'Many processes', 'processes', array('enabled' => false));

// Runs a docker command, through sudo -n when asked, and returns what it wrote. A daemon that does not
// answer is a host whose containers are all down: critical. Anything else that keeps docker from answering
// (sudo refusing, docker missing, the account outside the docker group) is a setting to fix.
function docker_run($sudo, $arguments) {
    $command = '/usr/bin/docker ' . $arguments;
    if ($sudo) {
        $command = 'sudo -n ' . $command;
    }
    $read = ssh.run($command);
    if ($read['exit'] != 0) {
        if (text.contains($read['errors'], 'Cannot connect to the Docker daemon')) {
            fail('critical', 'The Docker daemon is not running', $read['errors']);
        }
        if (text.contains($read['errors'], 'sudo')) {
            fail('misconfigured', 'sudo refused to run docker: see the sudoers line of the documentation', $read['errors']);
        }
        fail('misconfigured', 'docker did not answer', $read['errors']);
    }
    return $read['output'];
}

// One JSON object per line: {"Name": "web", "CPUPerc": "0.03%", "MemPerc": "0.24%", "PIDs": "2", ...}. A
// figure Docker could not read is written "--": it is not returned.
$output = docker_run($sudo, "stats --no-stream --format '{{json .}}'");
foreach (text.lines($output) as $line) {
    $container = json.read($line);
    $name = $container['Name'];
    $cpu = text.match($container['CPUPerc'], '^([0-9.]+)%$');
    if (list.count($cpu) > 0) {
        value('cpu', $cpu[1] + 0, $name);
    }
    $memory = text.match($container['MemPerc'], '^([0-9.]+)%$');
    if (list.count($memory) > 0) {
        value('memory', $memory[1] + 0, $name);
    }
    if (text.is_number($container['PIDs'])) {
        value('processes', $container['PIDs'] + 0, $name);
    }
}