4 ms·

so in the case of incidents, what do you do when no tool available in the container or debugging?

• nine_k 2y ago
  If you're debugging a running container and don't want to even restart it to instrument, you can enter its namespace from the outside and mount more directories with tools. Details: https://jpetazzo.github.io/2015/01/13/docker-mount-dynamic-volumes/ https://jpetazzo.github.io/2015/01/13/docker-mount-dynamic-v...
  • nsonha 2y ago
    just the file system is hardly enough for debugging
    • nine_k 2y ago
      Processes in a container are just normal processes. But if your container lacks gdb or strace or whatever other tools, you can bring them in.
    • lrvick 2y ago
      You can inject any binaries you want into a process namespace. Shipping debug tools, a package manager, or even a shell in a production container is increasing attack surface and image size for no reason. Do not ship dev tooling to prod. Pull and attach it on demand only. Servers and containers should be immutable appliances.