[Container] Run Process Debug Tools, But Install Nothing

Let’s say you want to “strace -p $nginx_pid“. But strace is not available in nginx:alpine image.

Login and install. Yes, it will work. But just old school.

docker exec -u root -it nginx-test sh

# Install strace
apk --update add strace

# strace nginx process
strace -p 1
##   strace: Process 1 attached
##   rt_sigsuspend([], 8

Why it’s old school? It will populate the env. Especially when the containers are in production mode.

The more packages you have installed, the more issues you will get.

(Similar reading: What Packages Were Installed In My Server, 5 Common Failures Of Package Installation)

Linux containers share the same linux kernel.

We can find the process id from docker host, then debug the process.

# get nginx process pid
root@denny:/tmp# ps -ef | grep nginx
root     27871 27834  0 22:00 pts/2    00:00:00 nginx: master process nginx -g daemon off;
systemd+ 27931 27871  0 22:00 pts/2    00:00:00 nginx: worker process
root     31324 27756  0 23:26 pts/1    00:00:00 grep --color=auto nginx

# Install tools in docker host
apt-get install -y strace

# Run tools from docker host
root@denny:/tmp# strace -p 27871
strace: Process 27871 attached
rt_sigsuspend([], 8

• Build a temporary image with tools installed

# Dockerfile
cat > Dockerfile <<EOF
FROM alpine
RUN apk update && apk add strace
CMD ["strace", "-p", "1"]
EOF

# Build image
docker build -t strace .

• Start a temporary container(nginx-test). Then debug nginx process by strace.

export test_conainter="nginx-test"
docker run -t --name strace-test \
  --pid=container:$test_conainter \
  --net=container:$test_conainter \
  --cap-add sys_admin \
  --cap-add sys_ptrace \
  strace

Don’t forget to destroy the container, when you have finished your debugging.

Apparently I like method3 the best. In this article, we use strace tool. Surely we can support more tools like this.

Not so difficult as you thought. Right, my friend?

So why don’t you give it a try now? Or share this post with your colleagues?

More Reading:

• Docker Tip: Run Daemon Service In Foreground
• Detect Suspicious Linux Processes
• How To Check Linux Process Deeply With Common Sense

Blog URL: https://www.dennyzhang.com/docker_debug