container: fix hostprocess memory metrics and containerd bundle handling (#2555)

Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

internal/headers/kernel32/job.go

@@ -18,6 +18,7 @@
 package kernel32
 
 import (
+	"errors"
 	"unsafe"
 
 	"golang.org/x/sys/windows"
@@ -45,15 +46,60 @@ func OpenJobObject(name string) (windows.Handle, error) {
 	return windows.Handle(handle), nil
 }
 
-func IsProcessInJob(process windows.Handle, job windows.Handle, result *bool) error {
+func IsProcessInJob(process windows.Handle, job windows.Handle) (bool, error) {
+	// IsProcessInJob writes a 4-byte BOOL.
+	var result int32
+
 	ret, _, err := procIsProcessInJob.Call(
 		uintptr(process),
 		uintptr(job),
 		uintptr(unsafe.Pointer(&result)),
 	)
 	if ret == 0 {
-		return err
+		return false, err
 	}
 
-	return nil
+	return result != 0, nil
+}
+
+// QueryJobObjectProcessIDs returns the IDs of all processes assigned to the job.
+func QueryJobObjectProcessIDs(job windows.Handle) ([]uint32, error) {
+	const headerSize = unsafe.Offsetof(JobObjectBasicProcessIDList{}.ProcessIdList)
+
+	headerEntries := int((headerSize + unsafe.Sizeof(uintptr(0)) - 1) / unsafe.Sizeof(uintptr(0)))
+	capacity := 16
+
+	for {
+		// Back the list with []uintptr, so the ULONG_PTR entries are aligned.
+		buf := make([]uintptr, headerEntries+capacity)
+		list := (*JobObjectBasicProcessIDList)(unsafe.Pointer(&buf[0]))
+
+		err := windows.QueryInformationJobObject(
+			job,
+			windows.JobObjectBasicProcessIdList,
+			uintptr(unsafe.Pointer(&buf[0])),
+			uint32(uintptr(len(buf))*unsafe.Sizeof(buf[0])),
+			nil,
+		)
+
+		if errors.Is(err, windows.ERROR_MORE_DATA) {
+			// Processes can join the job between two calls, so leave some headroom.
+			capacity = max(capacity*2, int(list.NumberOfAssignedProcesses)+16)
+
+			continue
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		ids := unsafe.Slice(&list.ProcessIdList[0], int(list.NumberOfProcessIdsInList))
+		pids := make([]uint32, len(ids))
+
+		for i, id := range ids {
+			pids[i] = uint32(id)
+		}
+
+		return pids, nil
+	}
 }

internal/headers/kernel32/job_test.go

@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// Copyright The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build windows
+
+package kernel32_test
+
+import (
+	"os/exec"
+	"testing"
+
+	"github.com/prometheus-community/windows_exporter/internal/headers/kernel32"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/windows"
+)
+
+// startJobProcesses starts count idle processes and assigns them to a new job object.
+func startJobProcesses(t *testing.T, count int) (windows.Handle, []uint32) {
+	t.Helper()
+
+	job, err := windows.CreateJobObject(nil, nil)
+	require.NoError(t, err)
+
+	t.Cleanup(func() {
+		_ = windows.TerminateJobObject(job, 0)
+		_ = windows.CloseHandle(job)
+	})
+
+	pids := make([]uint32, 0, count)
+
+	for range count {
+		// cmd.exe blocks on the open stdin pipe until the job is terminated.
+		cmd := exec.CommandContext(t.Context(), "cmd.exe", "/c", "pause")
+
+		stdin, err := cmd.StdinPipe()
+		require.NoError(t, err)
+		require.NoError(t, cmd.Start())
+
+		t.Cleanup(func() {
+			_ = stdin.Close()
+			_ = cmd.Process.Kill()
+			_ = cmd.Wait()
+		})
+
+		process, err := windows.OpenProcess(windows.PROCESS_SET_QUOTA|windows.PROCESS_TERMINATE, false, uint32(cmd.Process.Pid))
+		require.NoError(t, err)
+
+		err = windows.AssignProcessToJobObject(job, process)
+		_ = windows.CloseHandle(process)
+
+		require.NoError(t, err)
+
+		pids = append(pids, uint32(cmd.Process.Pid))
+	}
+
+	return job, pids
+}
+
+// More processes than the initial buffer holds must trigger ERROR_MORE_DATA and a retry.
+func TestQueryJobObjectProcessIDs(t *testing.T) {
+	t.Parallel()
+
+	job, pids := startJobProcesses(t, 20)
+
+	got, err := kernel32.QueryJobObjectProcessIDs(job)
+	require.NoError(t, err)
+	require.ElementsMatch(t, pids, got)
+}
+
+// IsProcessInJob wrote the BOOL into the pointer variable instead of the result,
+// so it always reported false.
+func TestIsProcessInJob(t *testing.T) {
+	t.Parallel()
+
+	job, pids := startJobProcesses(t, 1)
+
+	process, err := windows.OpenProcess(windows.PROCESS_QUERY_LIMITED_INFORMATION, false, pids[0])
+	require.NoError(t, err)
+
+	t.Cleanup(func() {
+		_ = windows.CloseHandle(process)
+	})
+
+	isInJob, err := kernel32.IsProcessInJob(process, job)
+	require.NoError(t, err)
+	require.True(t, isInJob)
+
+	isInJob, err = kernel32.IsProcessInJob(windows.CurrentProcess(), job)
+	require.NoError(t, err)
+	require.False(t, isInJob)
+}

internal/headers/kernel32/types.go

@@ -18,8 +18,6 @@
 package kernel32
 
 import (
-	"unsafe"
-
 	"golang.org/x/sys/windows"
 )
 
@@ -48,17 +46,16 @@ type JobObjectMemoryUsageInformation struct {
 	PeakJobMemoryUsed uint64
 }
 
+// JobObjectBasicProcessIDList is the fixed-size head of JOBOBJECT_BASIC_PROCESS_ID_LIST.
+// The ProcessIdList entries are ULONG_PTR and continue past the declared array;
+// use QueryJobObjectProcessIDs to read them.
+// https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-jobobject_basic_process_id_list
 type JobObjectBasicProcessIDList struct {
 	NumberOfAssignedProcesses uint32
 	NumberOfProcessIdsInList  uint32
 	ProcessIdList             [1]uintptr
 }
 
-// PIDs returns all the process Ids in the job object.
-func (p *JobObjectBasicProcessIDList) PIDs() []uint32 {
-	return unsafe.Slice((*uint32)(unsafe.Pointer(&p.ProcessIdList[0])), int(p.NumberOfProcessIdsInList))
-}
-
 type PROCESS_VM_COUNTERS struct {
 	PeakVirtualSize            uintptr
 	VirtualSize                uintptr