4 ms·
You might want at least a shell in the container for debugging?
by hssys 8y ago
You might want at least a shell in the container for debugging?
- souterrain 8y agoAdding a shell seems antithetical to deploying production code as a static-linked binary, not to mention an expansion of the attack surface of the container.
- hibbelig 8y agoWithout a shell, how does one debug if anything goes wrong?
- antsar 8y agoReading logs/traces on your log aggregation service and reproducing in a dev system?
- jeremyjh 8y agoHow do you debug in the dev env without a shell?
- y04nn 8y agoWith remote debugging?
- lstodd 8y agoremote debugging is a shell
- the8472 8y agonot necessarily. e.g. java runtimes can expose debugging ports when needed that operate on a custom protocol. or you can just build gdb into the container and run the process under gdb, then attach to the tty. or you can debug from the host system where the container's pid namespace is a descendant of the root namespace and the other namespaces can be accessed via /proc or unshare.
- lstodd 8y agoWhat I meant is having a remote debugger is as good as having a remote shell in terms of remote code execution.
- the8472 8y agofrom the host system, containers don't exist in a vacuum
- hundt 8y agoYou can start a container with a shell that shares the PID and network namespaces of the container you want to debug.
- discreteevent 8y agoDebugging is about when the difference between theory and practice breaks down.
- ecnahc515 8y agoYou can use nsenter
- ImJasonH 8y agoDistroless has debug images for this purpose: https://github.com/GoogleContainerTools/distroless/blob/master/README.md#debug-images https://github.com/GoogleContainerTools/distroless/blob/mast...