@aidra/pmx-io 0.0.0-stage → 9.13.0

package/lib/standalone/container.js

@@ -0,0 +1,909 @@
+// Copyright (c) 2026 Mike Warriner. All rights reserved. Proprietary — see LICENSE.
+'use strict'
+
+// Running in containers (specs/95-containers.md) for @aidra/pmx-io standalone mode (80 B.15):
+// detection (CTR-001…003), identity and metadata (CTR-010…017), the effective limits and the
+// container-aware host metrics (CTR-030…033). The JavaScript twin of pmx-core's container module
+// and pmx-io's _container.py: same detection order, names and metric maths. Host files are read
+// through a sysroot (env PMX_TEST_SYSROOT redirects /proc, /sys, /run and /.dockerenv to a
+// fixture tree, as in Rust and Python).
+
+const fs = require('fs')
+const os = require('os')
+const path = require('path')
+const debug = require('../debug')('axm:standalone')
+
+const MAX_NAME_LEN = 200
+
+class SysRoot {
+  constructor (root) {
+    this.root = root || '/'
+  }
+
+  static host () {
+    const p = process.env.PMX_TEST_SYSROOT
+    return new SysRoot(p || '/')
+  }
+
+  path (abs) {
+    return this.root === '/' ? abs : path.join(this.root, abs.replace(/^\/+/, ''))
+  }
+
+  read (abs) {
+    try {
+      return fs.readFileSync(this.path(abs), 'utf8')
+    } catch (_) {
+      return null
+    }
+  }
+
+  exists (abs) {
+    try {
+      fs.accessSync(this.path(abs))
+      return true
+    } catch (_) {
+      return false
+    }
+  }
+}
+
+function envFlag (v) {
+  if (v === undefined || v === null) return null
+  const s = String(v).trim().toLowerCase()
+  if (s === '1' || s === 'true') return true
+  if (s === '0' || s === 'false') return false
+  return null
+}
+
+function set (env, k) {
+  const v = env[k]
+  return v ? v : null
+}
+
+// -- detection (CTR-001…003) ----------------------------------------------------------------------
+
+const MOUNT_HINTS = ['/docker/containers/', '/containers/', '/kubelet/pods/']
+const CGROUP_HINTS = ['docker', 'kubepods', 'containerd', 'libpod', 'ecs']
+const ORCHESTRATORS = { ecs: 'ecs', kubernetes: 'kubernetes', k8s: 'kubernetes', compose: 'compose', none: 'none' }
+
+function mountinfoHint (text) {
+  for (const line of text.split('\n')) {
+    const f = line.split(/\s+/)
+    if (f.length > 4 && (f[4] === '/' || f[4] === '/etc/hostname') && MOUNT_HINTS.some((h) => line.includes(h))) return true
+  }
+  return false
+}
+
+function cgroupPaths (text) {
+  const out = []
+  for (const line of text.split('\n')) {
+    const parts = line.split(':')
+    if (parts.length >= 3) {
+      const p = parts.slice(2).join(':')
+      if (p) out.push(p)
+    }
+  }
+  return out
+}
+
+function cgroupHint (text) {
+  return cgroupPaths(text).some((p) => CGROUP_HINTS.some((h) => p.includes(h)))
+}
+
+function detect (env, root, linux) {
+  const dockerenv = root.exists('/.dockerenv')
+  const containerenv = root.exists('/run/.containerenv')
+  const cgroup1 = root.read('/proc/1/cgroup') || ''
+  const cgroupSelf = root.read('/proc/self/cgroup') || ''
+  const forced = envFlag(env.PMX_CONTAINER)
+  let inside
+  if (forced !== null) {
+    inside = forced
+  } else {
+    inside = linux && (dockerenv || containerenv || set(env, 'KUBERNETES_SERVICE_HOST') !== null ||
+      set(env, 'ECS_CONTAINER_METADATA_URI_V4') !== null || mountinfoHint(root.read('/proc/self/mountinfo') || '') || cgroupHint(cgroup1))
+  }
+  if (!inside) return { inContainer: false, runtime: 'unknown', orchestrator: 'none' }
+  const paths = cgroupPaths(cgroup1).concat(cgroupPaths(cgroupSelf))
+  const mentions = (w) => paths.some((p) => p.includes(w))
+  let runtime = 'unknown'
+  if (containerenv) runtime = 'podman'
+  else if (dockerenv || mentions('docker')) runtime = 'docker'
+  else if (mentions('containerd')) runtime = 'containerd'
+  let orch = ORCHESTRATORS[String(env.PMX_ORCHESTRATOR || '').trim().toLowerCase()]
+  if (!orch) {
+    if (set(env, 'ECS_CONTAINER_METADATA_URI_V4')) orch = 'ecs'
+    else if (set(env, 'KUBERNETES_SERVICE_HOST')) orch = 'kubernetes'
+    else if (set(env, 'COMPOSE_PROJECT_NAME')) orch = 'compose'
+    else orch = 'none'
+  }
+  return { inContainer: true, runtime, orchestrator: orch }
+}
+
+// -- identity (CTR-010…017) -----------------------------------------------------------------------
+
+const MOUNT_ID = /\/containers\/([0-9a-f]{64})\/|\/docker\/([0-9a-f]{64})/
+const POD_SUFFIXES = [/-[a-z0-9]{6,10}-[a-z0-9]{5}$/, /-[a-z0-9]{5}$/, /-[0-9]+$/]
+
+function containerIdFromFiles (mountinfo, cgroup) {
+  for (const line of mountinfo.split('\n')) {
+    const m = MOUNT_ID.exec(line)
+    if (m) return m[1] || m[2]
+  }
+  const found = cgroup.match(/[0-9a-f]{64}/g)
+  return found ? found[found.length - 1] : null
+}
+
+function serviceFromPod (pod) {
+  for (const rx of POD_SUFFIXES) {
+    const m = rx.exec(pod)
+    if (m && m.index > 0) return pod.slice(0, m.index)
+  }
+  return pod
+}
+
+function hostname () {
+  try {
+    return os.hostname() || 'localhost'
+  } catch (_) {
+    return 'localhost'
+  }
+}
+
+let RANDOM = null
+function processRandom () {
+  if (RANDOM === null) RANDOM = require('crypto').randomBytes(2).toString('hex')
+  return RANDOM
+}
+
+function truncateName (s) {
+  return s.slice(0, MAX_NAME_LEN)
+}
+
+function str (v) {
+  if (typeof v === 'string' && v) return v
+  if (typeof v === 'number' && Number.isFinite(v)) return String(v)
+  return null
+}
+
+function flt (v) {
+  if (typeof v === 'number' && Number.isFinite(v)) return v
+  if (typeof v === 'string' && v.trim() !== '') {
+    const n = Number(v.trim())
+    return Number.isFinite(n) ? n : null
+  }
+  return null
+}
+
+class EcsMetadata {
+  constructor (task, container) {
+    this.task = task || null
+    this.container = container || null
+  }
+
+  _t (k) { return this.task && typeof this.task === 'object' ? this.task[k] : undefined }
+  _c (k) { return this.container && typeof this.container === 'object' ? this.container[k] : undefined }
+  cluster () { return str(this._t('Cluster')) }
+  taskArn () { return str(this._t('TaskARN')) }
+  taskId () {
+    const arn = this.taskArn()
+    if (!arn) return null
+    const id = arn.split('/').pop()
+    return id || null
+  }
+
+  family () { return str(this._t('Family')) }
+  revision () { return str(this._t('Revision')) }
+  serviceName () { return str(this._t('ServiceName')) }
+  zone () { return str(this._t('AvailabilityZone')) }
+  taskCpus () {
+    const lim = this._t('Limits')
+    const v = lim && typeof lim === 'object' ? flt(lim.CPU) : null
+    return v !== null && v > 0 ? v : null
+  }
+
+  taskMemoryBytes () {
+    const lim = this._t('Limits')
+    const v = lim && typeof lim === 'object' ? flt(lim.Memory) : null
+    return v !== null && v > 0 ? Math.floor(v * 1024 * 1024) : null
+  }
+
+  dockerId () { return str(this._c('DockerId')) }
+  containerName () { return str(this._c('Name')) }
+  image () { return str(this._c('Image')) }
+}
+
+/** CTR-010: both ECS documents, 1 s timeout each, no retries (raw HTTP: never instrumented). */
+async function fetchEcs (base) {
+  const { httpRequest } = require('../transport/ws')
+  base = base.replace(/\/+$/, '')
+  const errors = []
+  const get = async (url) => {
+    try {
+      const res = await httpRequest('GET', url, null, { Accept: 'application/json' }, { timeout: 1000 })
+      if (res.status < 200 || res.status >= 300) throw new Error('HTTP ' + res.status)
+      const doc = JSON.parse(res.body.toString('utf8'))
+      if (doc && typeof doc === 'object') return doc
+      errors.push(`ECS metadata ${url}: invalid JSON`)
+    } catch (err) {
+      errors.push(`ECS metadata ${url}: ${err && err.message}`)
+    }
+    return null
+  }
+  const task = await get(base + '/task')
+  const container = await get(base)
+  for (const e of errors) debug('%s', e)
+  return new EcsMetadata(task, container)
+}
+
+const ENV_KEYS = ['PMX_SERVICE_NAME', 'PMX_INSTANCE_NAME', 'PMX_IMAGE', 'PMX_EPHEMERAL', 'POD_NAME', 'HOSTNAME', 'POD_NAMESPACE', 'COMPOSE_SERVICE']
+
+class ContainerInfo {
+  constructor (detection, ecs, root, env) {
+    this.detection = detection
+    this.ecs = ecs || new EcsMetadata()
+    this.root = root || new SysRoot()
+    this._env = {}
+    const e = env || {}
+    for (const k of ENV_KEYS) if (e[k] !== undefined) this._env[k] = e[k]
+    this._ecsUri = null
+  }
+
+  static detect (env, root, linux) {
+    const det = detect(env, root, linux)
+    const info = new ContainerInfo(det, null, root, env)
+    const uri = set(env, 'ECS_CONTAINER_METADATA_URI_V4')
+    if (det.inContainer && uri) info._ecsUri = uri
+    return info
+  }
+
+  ecsPending () {
+    return this._ecsUri !== null
+  }
+
+  async fetchEcs () {
+    const uri = this._ecsUri
+    this._ecsUri = null
+    if (!uri) return
+    this.ecs = await fetchEcs(uri)
+  }
+
+  inContainer () {
+    return this.detection.inContainer
+  }
+
+  env (k) {
+    const v = this._env[k]
+    return v || null
+  }
+
+  ephemeral () {
+    return this.inContainer() && envFlag(this.env('PMX_EPHEMERAL')) !== false
+  }
+
+  podName () {
+    if (this.detection.orchestrator !== 'kubernetes') return null
+    return this.env('POD_NAME') || this.env('HOSTNAME')
+  }
+
+  identity (firstApp, host) {
+    const ecs = this.ecs
+    const pod = this.podName()
+    let cid = ecs.dockerId()
+    if (cid === null && this.inContainer()) cid = containerIdFromFiles(this.root.read('/proc/self/mountinfo') || '', this.root.read('/proc/self/cgroup') || '')
+    const short = cid ? cid.slice(0, 12) : null
+    const service = this.env('PMX_SERVICE_NAME') || ecs.serviceName() || ecs.family() || (pod ? serviceFromPod(pod) : null) ||
+      this.env('COMPOSE_SERVICE') || firstApp || host
+    const taskId = ecs.taskId()
+    const instance = this.env('PMX_INSTANCE_NAME') || (taskId ? taskId.slice(0, 12) : null) || pod || short || host
+    let namespace = null
+    if (this.detection.orchestrator === 'kubernetes') {
+      namespace = this.env('POD_NAMESPACE')
+      if (namespace === null) namespace = (this.root.read('/var/run/secrets/kubernetes.io/serviceaccount/namespace') || '').trim() || null
+    }
+    return {
+      id: cid,
+      shortId: short,
+      name: ecs.containerName(),
+      image: ecs.image() || this.env('PMX_IMAGE'),
+      service,
+      instance,
+      task: ecs.taskArn() || pod,
+      taskShort: taskId || pod,
+      cluster: ecs.cluster(),
+      namespace,
+      revision: ecs.revision(),
+      zone: ecs.zone(),
+      hostname: host
+    }
+  }
+
+  nameContext (firstApp, host) {
+    if (!this.inContainer()) {
+      return { service: firstApp || host, instance: host, hostname: host, container: host, task: host, random: processRandom() }
+    }
+    const id = this.identity(firstApp, host)
+    return { service: id.service, instance: id.instance, hostname: host, container: id.shortId || host, task: id.taskShort || id.instance, random: processRandom() }
+  }
+
+  defaultMachineName (firstApp, host) {
+    if (!this.inContainer()) return null
+    const id = this.identity(firstApp, host)
+    return truncateName(`${id.service}@${id.instance}`)
+  }
+
+  cgroup () {
+    return Cgroup.locate(this.root)
+  }
+
+  block (firstApp, host, limits) {
+    const id = this.identity(firstApp, host)
+    return {
+      runtime: this.detection.runtime,
+      orchestrator: this.detection.orchestrator,
+      id: id.id,
+      name: id.name,
+      image: id.image,
+      service: id.service,
+      instance: id.instance,
+      task: id.task,
+      cluster: id.cluster,
+      namespace: id.namespace,
+      revision: id.revision,
+      zone: id.zone,
+      limits: limits.toJSON()
+    }
+  }
+}
+
+function expand (name, ctx) {
+  let out = name
+  for (const k of ['service', 'instance', 'hostname', 'container', 'task', 'random']) out = out.split('{' + k + '}').join(ctx[k] || '')
+  return truncateName(out)
+}
+
+let INFO = null
+/** Detected once per process from process.env and the sysroot (ECS metadata: fetchEcs()). */
+function globalInfo () {
+  if (!INFO) INFO = ContainerInfo.detect(process.env, SysRoot.host(), process.platform === 'linux')
+  return INFO
+}
+
+function resetForTests () {
+  INFO = null
+  RANDOM = null
+}
+
+// -- cgroup (CTR-030) -----------------------------------------------------------------------------
+
+function unescapeMount (s) {
+  return s.replace(/\\([0-7]{3})/g, (_, o) => String.fromCharCode(parseInt(o, 8)))
+}
+
+function parseMountinfo (text) {
+  const out = []
+  for (const line of text.split('\n')) {
+    const sep = line.indexOf(' - ')
+    if (sep === -1) continue
+    const f = line.slice(0, sep).split(/\s+/)
+    const p = line.slice(sep + 3).split(/\s+/)
+    if (f.length < 5 || !p.length) continue
+    out.push({ root: unescapeMount(f[3]), point: unescapeMount(f[4]), fstype: p[0], source: p[1] ? unescapeMount(p[1]) : '', superOpts: p[2] || '' })
+  }
+  return out
+}
+
+function countCpuList (s) {
+  s = String(s || '').trim()
+  if (!s) return null
+  let n = 0
+  for (let part of s.split(',')) {
+    part = part.trim()
+    if (part.includes('-')) {
+      const [a, b] = part.split('-', 2)
+      const lo = Number(a)
+      const hi = Number(b)
+      if (!Number.isInteger(lo) || !Number.isInteger(hi) || a.trim() === '' || b.trim() === '' || hi < lo) return null
+      n += hi - lo + 1
+    } else {
+      if (!/^\d+$/.test(part)) return null
+      n += 1
+    }
+  }
+  return n
+}
+
+function kv (text, key) {
+  if (text === null || text === undefined) return null
+  for (const line of text.split('\n')) {
+    const parts = line.trim().split(/\s+/)
+    if (parts.length >= 2 && parts[0] === key) {
+      const n = Number(parts[1])
+      return Number.isFinite(n) && /^-?\d+$/.test(parts[1]) ? n : null
+    }
+  }
+  return null
+}
+
+function int (s) {
+  const n = Number(s)
+  return Number.isFinite(n) ? n : 0
+}
+
+function parseIoStat (text) {
+  let r = 0
+  let w = 0
+  for (const line of text.split('\n')) {
+    for (const tok of line.trim().split(/\s+/).slice(1)) {
+      if (tok.startsWith('rbytes=')) r += int(tok.slice(7))
+      else if (tok.startsWith('wbytes=')) w += int(tok.slice(7))
+    }
+  }
+  return [r, w]
+}
+
+function parseBlkio (text) {
+  let r = 0
+  let w = 0
+  for (const line of text.split('\n')) {
+    const f = line.trim().split(/\s+/)
+    if (f.length === 3) {
+      if (f[1] === 'Read') r += int(f[2])
+      else if (f[1] === 'Write') w += int(f[2])
+    }
+  }
+  return [r, w]
+}
+
+function readFile (p) {
+  try {
+    return fs.readFileSync(p, 'utf8')
+  } catch (_) {
+    return null
+  }
+}
+
+function isDir (p) {
+  try {
+    return fs.statSync(p).isDirectory()
+  } catch (_) {
+    return false
+  }
+}
+
+function optInt (t) {
+  if (t === null || t === undefined) return null
+  const s = String(t).trim()
+  if (!/^-?\d+$/.test(s)) return null
+  return Number(s)
+}
+
+const V1_UNLIMITED = 2 ** 60
+const V1_CONTROLLERS = ['cpu', 'cpuacct', 'cpuset', 'memory', 'blkio']
+
+class Cgroup {
+  constructor (version, v2, v1) {
+    this.version = version
+    this.v2 = v2 || null
+    this.v1 = v1 || {}
+  }
+
+  static locate (root) {
+    const text = root.read('/proc/self/cgroup')
+    if (text === null) return null
+    const mounts = parseMountinfo(root.read('/proc/self/mountinfo') || '')
+    const v1 = {}
+    let v2Path = null
+    for (const line of text.split('\n')) {
+      const parts = line.split(':')
+      if (parts.length < 3) continue
+      const ctrls = parts[1]
+      const p = parts.slice(2).join(':')
+      if (!ctrls) {
+        v2Path = p
+        continue
+      }
+      for (const c of ctrls.split(',')) {
+        if (!V1_CONTROLLERS.includes(c) || v1[c]) continue
+        const mount = mounts.find((m) => m.fstype === 'cgroup' && m.superOpts.split(',').includes(c))
+        let rel = p
+        let base
+        if (mount) {
+          if (mount.root !== '/' && p.startsWith(mount.root)) rel = p.slice(mount.root.length)
+          base = root.path(mount.point)
+        } else {
+          base = root.path('/sys/fs/cgroup/' + c)
+        }
+        const joined = path.join(base, rel.replace(/^\/+/, ''))
+        v1[c] = isDir(joined) ? joined : base
+      }
+    }
+    if (Object.keys(v1).length) return new Cgroup(1, null, v1)
+    if (v2Path === null) return null
+    const mount = mounts.find((m) => m.fstype === 'cgroup2')
+    const point = mount ? mount.point : '/sys/fs/cgroup'
+    const mroot = mount ? mount.root : '/'
+    let rel = v2Path
+    if (mroot !== '/' && rel.startsWith(mroot)) rel = rel.slice(mroot.length)
+    const base = root.path(point)
+    const joined = path.join(base, rel.replace(/^\/+/, ''))
+    return new Cgroup(2, isDir(joined) ? joined : base)
+  }
+
+  _v1 (controller, name) {
+    const d = this.v1[controller]
+    return d ? readFile(path.join(d, name)) : null
+  }
+
+  _v2 (name) {
+    if (this.version !== 2 || !this.v2) return null
+    return readFile(path.join(this.v2, name))
+  }
+
+  cpuQuota () {
+    let q
+    let p
+    if (this.version === 2) {
+      const t = this._v2('cpu.max')
+      if (t === null) return null
+      const parts = t.trim().split(/\s+/)
+      if (!parts.length || parts[0] === 'max' || parts.length < 2) return null
+      q = Number(parts[0])
+      p = Number(parts[1])
+    } else {
+      const tq = this._v1('cpu', 'cpu.cfs_quota_us')
+      const tp = this._v1('cpu', 'cpu.cfs_period_us')
+      if (tq === null || tp === null) return null
+      const qi = optInt(tq)
+      if (qi === null || qi <= 0) return null
+      q = qi
+      p = Number(tp.trim())
+    }
+    if (!Number.isFinite(q) || !Number.isFinite(p)) return null
+    return q > 0 && p > 0 ? q / p : null
+  }
+
+  cpusetCount () {
+    const t = this.version === 2 ? this._v2('cpuset.cpus.effective') : (this._v1('cpuset', 'cpuset.effective_cpus') || this._v1('cpuset', 'cpuset.cpus'))
+    return t !== null ? countCpuList(t) : null
+  }
+
+  memoryLimit () {
+    if (this.version === 2) {
+      const t = this._v2('memory.max')
+      if (t === null || t.trim() === 'max') return null
+      return optInt(t)
+    }
+    const v = optInt(this._v1('memory', 'memory.limit_in_bytes'))
+    return v !== null && v < V1_UNLIMITED ? v : null
+  }
+
+  sample () {
+    if (this.version === 2) {
+      const cpu = this._v2('cpu.stat') || ''
+      const stat = this._v2('memory.stat')
+      const ev = this._v2('memory.events')
+      const io = this._v2('io.stat')
+      return {
+        usageUsec: kv(cpu, 'usage_usec'),
+        nrPeriods: kv(cpu, 'nr_periods'),
+        nrThrottled: kv(cpu, 'nr_throttled'),
+        memCurrent: optInt(this._v2('memory.current')),
+        inactiveFile: stat !== null ? kv(stat, 'inactive_file') : null,
+        oomKill: ev !== null ? kv(ev, 'oom_kill') : null,
+        io: io !== null ? parseIoStat(io) : null
+      }
+    }
+    const cpu = this._v1('cpu', 'cpu.stat') || ''
+    const usage = optInt(this._v1('cpuacct', 'cpuacct.usage'))
+    const stat = this._v1('memory', 'memory.stat')
+    const oom = this._v1('memory', 'memory.oom_control')
+    const blk = this._v1('blkio', 'blkio.throttle.io_service_bytes') || this._v1('blkio', 'blkio.throttle.io_service_bytes_recursive')
+    return {
+      usageUsec: usage !== null ? Math.floor(usage / 1000) : null,
+      nrPeriods: kv(cpu, 'nr_periods'),
+      nrThrottled: kv(cpu, 'nr_throttled'),
+      memCurrent: optInt(this._v1('memory', 'memory.usage_in_bytes')),
+      inactiveFile: stat !== null ? kv(stat, 'total_inactive_file') : null,
+      oomKill: oom !== null ? kv(oom, 'oom_kill') : null,
+      io: blk !== null ? parseBlkio(blk) : null
+    }
+  }
+}
+
+function onlineCpus (root) {
+  const t = root.read('/sys/devices/system/cpu/online')
+  const n = t !== null ? countCpuList(t) : null
+  if (n) return n
+  return (os.cpus() || []).length || 1
+}
+
+function num (v) {
+  return Number.isInteger(v) ? v : v
+}
+
+class Limits {
+  constructor (cpus, hasQuota, memoryBytes) {
+    this.cpus = cpus
+    this.hasQuota = hasQuota
+    this.memoryBytes = memoryBytes
+  }
+
+  static effective (cg, root, ecsCpus, ecsMem, hostTotal) {
+    const online = onlineCpus(root)
+    const quota = cg ? cg.cpuQuota() : null
+    const cpuset = cg ? cg.cpusetCount() : null
+    const cands = [quota, ecsCpus && ecsCpus > 0 ? ecsCpus : null, cpuset, online].filter((c) => c !== null && c !== undefined)
+    const cpus = cands.length ? Math.min(...cands) : online
+    const mems = [cg ? cg.memoryLimit() : null, ecsMem && ecsMem > 0 ? ecsMem : null, hostTotal > 0 ? hostTotal : null].filter((m) => m !== null && m !== undefined)
+    const mem = mems.length ? Math.min(...mems) : hostTotal
+    return new Limits(cpus, quota !== null, mem)
+  }
+
+  toJSON () {
+    return { cpus: num(this.cpus), memoryBytes: this.memoryBytes }
+  }
+
+  cpusRoundedUp () {
+    return Math.max(1, Math.ceil(this.cpus))
+  }
+}
+
+// -- metrics (CTR-032/033, prodman APM-030 on hosts) ----------------------------------------------
+
+function metric (value, unit) {
+  return { value, type: 'metric', unit, historic: true }
+}
+
+function round (v, d) {
+  const f = 10 ** d
+  return Math.round(v * f) / f
+}
+
+function containerValues (limits, prev, cur) {
+  const out = {}
+  const dt = prev ? prev[1] : 0
+  const p = prev ? prev[0] : null
+  const delta = (key) => {
+    const c = cur[key]
+    if (c === null || c === undefined) return [false, null]
+    if (!p || dt <= 0 || p[key] === null || p[key] === undefined) return [true, null]
+    return [true, Math.max(0, c - p[key])]
+  }
+  const [has, du] = delta('usageUsec')
+  if (has) {
+    let pct = 0
+    if (du !== null && dt > 0 && limits.cpus > 0) pct = Math.min(100, Math.max(0, du / (dt * 1e6 * limits.cpus) * 100))
+    out['CPU Usage'] = metric(round(pct, 1), '%')
+  }
+  if (limits.hasQuota) {
+    const [hp, dp] = delta('nrPeriods')
+    const [ht, dthr] = delta('nrThrottled')
+    if (hp && ht) {
+      let pct = 0
+      if (dp !== null && dthr !== null && dp > 0) pct = Math.min(100, dthr / dp * 100)
+      out['CPU Throttled'] = metric(round(pct, 1), '%')
+    }
+  }
+  const total = limits.memoryBytes
+  const current = cur.memCurrent
+  if (current !== null && current !== undefined) {
+    const active = Math.max(0, current - (cur.inactiveFile || 0))
+    const usage = total > 0 ? round(active / total * 100, 1) : 0
+    out['RAM Usage'] = metric(usage, '%')
+    out['RAM Total'] = metric(total, 'b')
+    out['RAM Available'] = metric(Math.max(0, total - active), 'b')
+    out['RAM Active'] = metric(active, 'b')
+  } else if (total > 0) {
+    out['RAM Total'] = metric(total, 'b')
+  }
+  const io = cur.io
+  if (io) {
+    let rr = 0
+    let wr = 0
+    if (p && dt > 0 && p.io) {
+      rr = Math.max(0, io[0] - p.io[0]) / dt
+      wr = Math.max(0, io[1] - p.io[1]) / dt
+    }
+    out['Disk Reads'] = metric(round(rr / 1e6, 3), 'mb/s')
+    out['Disk Writes'] = metric(round(wr / 1e6, 3), 'mb/s')
+  }
+  if (cur.oomKill !== null && cur.oomKill !== undefined) out['OOM Kills'] = metric(cur.oomKill, '')
+  return out
+}
+
+const PSEUDO_FS = ['proc', 'sysfs', 'tmpfs', 'devtmpfs', 'mqueue', 'devpts', 'securityfs', 'debugfs', 'tracefs', 'pstore', 'bpf', 'fusectl',
+  'configfs', 'hugetlbfs', 'autofs', 'binfmt_misc', 'nsfs', 'ramfs', 'rpc_pipefs', 'efivarfs', 'selinuxfs']
+
+function containerFsMounts (mountinfo) {
+  const out = []
+  for (const m of parseMountinfo(mountinfo)) {
+    const pt = m.point
+    let keep
+    if (pt === '/') {
+      keep = true
+    } else {
+      const fsType = m.fstype
+      keep = !(PSEUDO_FS.includes(fsType) || fsType.startsWith('cgroup') || fsType === 'overlay' ||
+        ['/proc', '/sys', '/dev'].some((x) => pt === x || pt.startsWith(x + '/')))
+    }
+    if (keep && !out.includes(pt)) out.push(pt)
+  }
+  return out
+}
+
+function readNetDev (root) {
+  const text = root.read('/proc/net/dev') || ''
+  const out = {}
+  for (const line of text.split('\n').slice(2)) {
+    const i = line.indexOf(':')
+    if (i === -1) continue
+    const name = line.slice(0, i).trim()
+    const f = line.slice(i + 1).trim().split(/\s+/)
+    if (!/^[A-Za-z0-9._-]+$/.test(name) || f.length < 12) continue
+    const v = [f[0], f[8], f[2], f[10], f[3], f[11]].map(Number)
+    if (v.some((x) => !Number.isFinite(x))) continue
+    out[name] = v
+  }
+  return out
+}
+
+function readMeminfo (root) {
+  const text = root.read('/proc/meminfo') || ''
+  const out = {}
+  for (const line of text.split('\n')) {
+    const parts = line.trim().split(/\s+/)
+    if (parts.length >= 2 && parts[0].endsWith(':')) {
+      const n = Number(parts[1])
+      if (!Number.isFinite(n)) continue
+      out[parts[0].slice(0, -1)] = n * (parts[2] === 'kB' ? 1024 : 1)
+    }
+  }
+  return out
+}
+
+function hostTotalMemory (root) {
+  const mi = readMeminfo(root)
+  if (mi.MemTotal) return mi.MemTotal
+  return os.totalmem()
+}
+
+function procStatCpu (root) {
+  const text = root.read('/proc/stat') || ''
+  for (const line of text.split('\n')) {
+    if (line.startsWith('cpu ')) {
+      const vals = line.trim().split(/\s+/).slice(1).map(Number)
+      if (vals.some((x) => !Number.isFinite(x))) return null
+      const idle = vals[3] + (vals.length > 4 ? vals[4] : 0)
+      const total = vals.slice(0, 8).reduce((a, b) => a + b, 0)
+      return [total - idle, total]
+    }
+  }
+  return null
+}
+
+class HostMetrics {
+  constructor (info) {
+    this.info = info
+    this.root = info.root
+    this.cgroup = info.inContainer() ? info.cgroup() : null
+    this._prevCg = null
+    this._prevCpu = null
+    this._prevNet = {}
+    this._last = null
+    this._fsAt = 0
+    this._fs = {}
+  }
+
+  limits () {
+    return Limits.effective(this.cgroup, this.root, this.info.ecs.taskCpus(), this.info.ecs.taskMemoryBytes(), hostTotalMemory(this.root))
+  }
+
+  collect () {
+    try {
+      return this.info.inContainer() ? this._container() : this._host()
+    } catch (err) {
+      debug('system metrics failed: %s', err && err.message)
+      return {}
+    }
+  }
+
+  _host () {
+    const out = {}
+    const cpu = procStatCpu(this.root)
+    if (cpu) {
+      const prev = this._prevCpu
+      this._prevCpu = cpu
+      if (prev && cpu[1] > prev[1]) {
+        const pct = (cpu[0] - prev[0]) / (cpu[1] - prev[1]) * 100
+        out['CPU Usage'] = metric(round(Math.min(100, Math.max(0, pct)), 1), '%')
+      }
+    }
+    const mi = readMeminfo(this.root)
+    const total = mi.MemTotal || hostTotalMemory(this.root)
+    if (total) {
+      const avail = mi.MemAvailable !== undefined ? mi.MemAvailable : (mi.MemFree !== undefined ? mi.MemFree : os.freemem())
+      out['RAM Total'] = metric(total, 'b')
+      const active = Math.max(0, total - avail)
+      out['RAM Available'] = metric(avail, 'b')
+      out['RAM Active'] = metric(active, 'b')
+      out['RAM Usage'] = metric(round(active / total * 100, 1), '%')
+    }
+    return out
+  }
+
+  _container () {
+    const now = Date.now() / 1000
+    const dt = this._last !== null ? now - this._last : 0
+    this._last = now
+    const limits = this.limits()
+    const cur = this.cgroup ? this.cgroup.sample() : {}
+    const prev = this._prevCg
+    this._prevCg = [now, cur]
+    const out = containerValues(limits, prev ? [prev[1], now - prev[0]] : null, cur)
+    const net = readNetDev(this.root)
+    for (const iface of Object.keys(net)) {
+      const c = net[iface]
+      const p = this._prevNet[iface]
+      const rate = (i) => (!p || dt <= 0 ? 0 : Math.max(0, c[i] - p[i]) / dt)
+      out['net:rx_5:' + iface] = metric(round(rate(0) / 1e6, 3), 'mb/s')
+      out['net:tx_5:' + iface] = metric(round(rate(1) / 1e6, 3), 'mb/s')
+      for (const [k, i] of [['rx_errors_60', 2], ['tx_errors_60', 3], ['rx_dropped_60', 4], ['tx_dropped_60', 5]]) {
+        out[`net:${k}:${iface}`] = metric(Math.round(rate(i) * 60), '/min')
+      }
+    }
+    this._prevNet = net
+    Object.assign(out, this._filesystems(now))
+    return out
+  }
+
+  _filesystems (now) {
+    if (now - this._fsAt < 5 && Object.keys(this._fs).length) return this._fs
+    this._fsAt = now
+    const fsOut = {}
+    const text = this.root.read('/proc/self/mountinfo')
+    if (text && typeof fs.statfsSync === 'function') {
+      for (const mp of containerFsMounts(text)) {
+        if (!isDir(mp)) continue
+        let st
+        try {
+          st = fs.statfsSync(mp)
+        } catch (_) {
+          continue
+        }
+        const bsize = st.bsize
+        const total = st.blocks * bsize
+        const used = total - st.bfree * bsize
+        const avail = st.bavail * bsize
+        if (used + avail <= 0) continue
+        fsOut['fs:use:' + mp] = metric(round(used / (used + avail) * 100, 2), '%')
+        fsOut['fs:size:' + mp] = metric(round(total / 1e9, 2), 'gb')
+      }
+    }
+    this._fs = fsOut
+    return fsOut
+  }
+}
+
+module.exports = {
+  SysRoot,
+  detect,
+  ContainerInfo,
+  EcsMetadata,
+  Cgroup,
+  Limits,
+  HostMetrics,
+  globalInfo,
+  resetForTests,
+  expand,
+  truncateName,
+  hostname,
+  serviceFromPod,
+  containerIdFromFiles,
+  containerValues,
+  containerFsMounts,
+  countCpuList,
+  parseMountinfo,
+  hostTotalMemory,
+  envFlag
+}