6 ms·
You might want at least a shell in the container for debugging?
by hssys 7y ago
You might want at least a shell in the container for debugging?
- souterrain 7y agoAdding a shell seems antithetical to deploying production code as a static-linked binary, not to mention an expansion of the attack surface of the container.
- discreteevent 7y agoDebugging is about when the difference between theory and practice breaks down.
- hibbelig 7y agoWithout a shell, how does one debug if anything goes wrong?
- antsar 7y agoReading logs/traces on your log aggregation service and reproducing in a dev system?
- jeremyjh 7y agoHow do you debug in the dev env without a shell?
- y04nn 7y agoWith remote debugging?
- lstodd 7y agoremote debugging is a shell
- the8472 7y agonot necessarily. e.g. java runtimes can expose debugging ports when needed that operate on a custom protocol. or you can just build gdb into the container and run the process under gdb, then attach to the tty. or you can debug from the host system where the container's pid namespace is a descendant of the root namespace and the other namespaces can be accessed via /proc or unshare.
- lstodd 7y agoWhat I meant is having a remote debugger is as good as having a remote shell in terms of remote code execution.
- the8472 7y agofrom the host system, containers don't exist in a vacuum
- hundt 7y agoYou can start a container with a shell that shares the PID and network namespaces of the container you want to debug.
- ecnahc515 7y agoYou can use nsenter
- ImJasonH 7y agoDistroless has debug images for this purpose: https://github.com/GoogleContainerTools/distroless/blob/master/README.md#debug-images https://github.com/GoogleContainerTools/distroless/blob/mast...