2 of 2 people found this helpful
Within a single pattern invocation they are additive. So if you call it multiple times in a single pattern execution then you can add multiple relationships. On the next invocation it will update them.
OK, I just noticed that the Docker pattern break the loop at the first process found. I will do some tests and raise a customer ticket.
The loop iterate by processes - descendants of the Docker daemon process, each of them is the process of Docker container.
Assumed, then each Docker container has only one initiate process - "docker-containerd-shim", so break in that case is correct.
Then pattern looking for descendants for Container process and related SIs for it
The Docker pattern is creating SoftwareContainer from the result of a docker command, searching for an ID in the processes arguments. A single ID can be present on multiple docker-containerd-shim processes.
It's important to connect all processes, so the SI behind can be then connected to the Docker container.
So for us the break is incorrect