Run the zero-code agent as a container, why it needs host PID access and not privileged mode, and how to preview the exact command before running it.
One agent container per host, observing every other container on it.
Availability. The zero-code agent is an early-access distribution. It is
installable, upgradable and tested, and it is not yet an integrated part of
the product: there is no dashboard page for it, no in-product installer and
no self-service download. Ask your account contact for access.Its telemetry, once flowing, is ordinary OTLP and needs nothing special —
it appears in Services, Traces and Metrics exactly like SDK telemetry does.
That is the design rather than a shortcut.
Before you start, you need two values.
Your base endpoint — shown on Get Started in the dashboard. These
pages write it as $OIQ_ENDPOINT.
A license key — created in Settings → License Keys, starting
oiq_. Requires the Admin role. See
Create a license key. These pages write it as
$OIQ_LICENSE_KEY.
Export both before running anything below:
export OIQ_ENDPOINT="https://app.aiaxoniq.com/otlp" # or your ownexport OIQ_LICENSE_KEY="oiq_..."
The kernel belongs to the host, so the requirements apply there — the base
image of your workloads is irrelevant. A distroless container and a full
distribution container are equally observable.
./bin/oiq-zerocode-preflight
See Install on Linux for how to read
the output, and for the perf_event_paranoid setting that must be fixed before
the default profile will collect anything.
--pid host is required, and its absence is silent.Observing processes in other containers means sharing the host’s PID
namespace. Without it the agent starts, reports healthy, discovers exactly
one process — itself — and produces essentially nothing.There is no error anywhere. If your service inventory did not grow after
installing, check this first.
It is not --privileged. The run script drops ALL capabilities and
adds back exactly the profile’s set. A privileged container has effectively
unrestricted host access, which is not what anyone thinks they agreed to when
installing an observability agent.Verify with docker inspect if you want to see it rather than read it.
Docker Desktop on macOS or Windows works, and will mislead you. Your
containers run inside a Linux virtual machine, so the agent observes what
runs in that VM — which is your containers, and nothing else on your
machine.It is fine for evaluating the agent. It is a poor basis for a demo, and a
worse basis for estimating what you will see in production.
