4 ms·
A good pattern is to build an image specifically containing troubleshooting tools which can be run and attached to a problem container's namespace. That gives y
by seneca 7y ago
A good pattern is to build an image specifically containing troubleshooting tools which can be run and attached to a problem container's namespace. That gives you a standard set of tools without having to bake them into every image.
- downerending 7y agoIs there more doc on this idea somewhere? In particular, being able to strace without root (etc) would make life a lot easier.
- geofft 7y agoFYI, you don't need any special permissions to strace in a docker container - you just need to disable the default seccomp profile (docker run --security-opt seccomp=unconfined), which blocks use of many unusual-in-production syscalls including ptrace: https://docs.docker.com/engine/security/seccomp/ https://docs.docker.com/engine/security/seccomp/ One common workaround floating around the internets is to use --cap-add SYS_PTRACE. This has the side effect of permitting the ptrace syscall, but it also gives you the ability to ptrace processes owned by other users etc. That's more than you need and it's kind of dangerous in a production-ish container.
- downerending 7y agoI might be thinking of a different scenario (and I'm generally using Singularity rather than Docker). I want to start my container under 'strace' and see everything. This is not generally possible in the obvious way, as there's a setuid-root binary in the process tree that blocks further strace'ing. (One can still attach after everything's running, but that's not always good enough.)