Showing docker container name in ps list

Question

I have a very simple Ubuntu container with apache running into it. When I started the container with:

$ sudo docker run -p 192.168.189.134:80:80 -d wnoorduin/apache

where 192.168.189.134 is my IP-address and look at the processes on the docker host, I see:

$ sudo ps -ef | grep docker root 35701 1 0 13:46 ?
00:00:14 /usr/bin/docker daemon root 37825 35701 0 14:47 ?
00:00:00 docker-proxy -proto tcp -host-ip 192.168.189.134 -host-port 80 -container-ip 172.17.0.2 -container-port 80 root 37946 3465 0 14:53 pts/0 00:00:00 grep --color=auto docker

root@willems-vm:/# ps -ef | grep apache root 37832 35701 0 14:47 ? 00:00:00 /bin/sh /usr/sbin/apache2ctl -D FOREGROUND root
37856 37832 0 14:47 ? 00:00:00 /usr/sbin/apache2 -D FOREGROUND www-data 37857 37856 0 14:47 ? 00:00:00 /usr/sbin/apache2 -D FOREGROUND www-data 37858 37856 0 14:47 ? 00:00:00 /usr/sbin/apache2 -D FOREGROUND root 37950 3465 0 14:54 pts/0
00:00:00 grep --color=auto apache

and:

root@willems-vm:/# ps -efZ | grep docker unconfined
root 35701 1 0 13:46 ? 00:00:14 /usr/bin/docker daemon unconfined root 37825 35701 0 14:47 ?
00:00:00 docker-proxy -proto tcp -host-ip 192.168.189.134 -host-port 80 -container-ip 172.17.0.2 -container-port 80 docker-default
root 37832 35701 0 14:47 ? 00:00:00 /bin/sh /usr/sbin/apache2ctl -D FOREGROUND docker-default
root 37856 37832 0 14:47 ? 00:00:00 /usr/sbin/apache2 -D FOREGROUND docker-default www-data 37857 37856 0 14:47 ? 00:00:00 /usr/sbin/apache2 -D FOREGROUND docker-default www-data 37858 37856 0 14:47 ? 00:00:00 /usr/sbin/apache2 -D FOREGROUND unconfined root 37952 3465 0 14:55 pts/0 00:00:00 grep --color=auto docker

So after putting the Z of SELinux in this, I can confirm the the apache2 process is coming from a docker container. Back in my good days, when I was configuring Solaris Containers, it was actually possible to see the zone-name (this was called a zone) in the ps listing (if I remember, it was also ps -efZ, but Z had a totally different meaning then).

When running one container this is not so disastrous, but when running 10, you cannot track the process down to the container. So: Is there a way to do that on the docker host, without the docker commnd ?

Answer 1

The regular old ps command is not docker aware, so it isn't possible to see container names using that.

There is a tool called sysdig that is really quite powerful. It can show lots of different things, and it is container aware.

The only thing that some might consider a drawback is that sysdig requires a kernel module to work. It collects data on what processes are actually doing and can get really meaningful insight into the health and status of anything on a system.

I usually run the csysdig tool to get a curses interactive type tool.

Running sudo csysdig -pc gives me the following view of processes:

Viewing: Processes For: whole machine
Source: Live System Filter: evt.type!=switch
   PID    VPID     CPU USER          TH     VIRT      RES    FILE     NET Container           Command
 27485   27485    2.00 root           1     132M      37M       0    0.00 host                csysdig -pc
 29099       7    0.50 root          18       3G     369M       0    0.00 boss_twilight       java -XX:MaxPermSize=128M
 30969     241    0.50               42       2G     325M       0   2.18K gitlab              sidekiq 3.3.0 gitlab-rails
 30137      93    0.50               52       1G      42M       0  274.50 splunk              mongod --dbpath=/opt/splun
 29236      16    0.50 root          30       3G       1G       0    0.00 bossmc_forge-1.7.10 java -XX:MaxPermSize=128M
 32654       7    0.50 root           1      96M      12M       0  18.84K bossmc_lanannounce  python lanannounce.py
 30965     237    0.50                3      38M       2M      7K  183.50 gitlab              /opt/gitlab/embedded/bin/r
 28597   28597    0.00 root           5     106M     464K       0    0.00 host                /usr/bin/docker-proxy -pro
 31029     270    0.00                1      27M       2M       0    0.00 gitlab              postgres: stats collector
 28542   28542    0.00 root           6     114M     468K       0    0.00 host                /usr/bin/docker-proxy -pro
 28500   28500    0.00 root           5      42M     444K       0    0.00 host                /usr/bin/docker-proxy -pro
 28517   28517    0.00 root           5     106M     580K       0    0.00 host                /usr/bin/docker-proxy -pro
 28366   28366    0.00 root           5      42M     176K       0    0.00 host                /usr/bin/docker-proxy -pro
 17675   17675    0.00 root           1      19M       1M       0    0.00 host                /lib/systemd/systemd-login
 28409   28409    0.00 root           5      42M     420K       0    0.00 host                /usr/bin/docker-proxy -pro
 28634   28634    0.00 root           6      50M     388K       0    0.00 host                /usr/bin/docker-proxy -pro
     1       1    0.00 root           1      28M       3M       0    0.00 host                /lib/systemd/systemd --sys
 31289     282    0.00                1      19M       3M       6    0.00 gitlab              /bin/bash /opt/gitlab/embe
 28613   28613    0.00 root           5     106M     404K       0    0.00 host                /usr/bin/docker-proxy -pro
 30941     223    0.00 root           1       4M       1M       0    0.00 gitlab              runsv logrotate
 29409      12    0.00 root           1      20M      12K       0    0.00 auto-proxy          /bin/bash -c source ".prof
 28643   28643    0.00 root           5     106M     500K       0    0.00 host                /usr/bin/docker-proxy -pro
 31696     353    0.00                2     374M     107M       0    0.00 gitlab              unicorn worker[3] -D -E pr
   668     668    0.00 root           1      14M     180K       0    0.00 host                /sbin/agetty --noclear tty
 30948     230    0.00 root           1       4M     584K       0    0.00 gitlab              svlogd -tt /var/log/gitlab
 28508   28508    0.00 root           6     115M     764K       0    0.00 host                /usr/bin/docker-proxy -pro
   659     659    0.00 root           1       4M     176K       0    0.00 host                /usr/sbin/acpid
F1Help  F2Views F4FilterF5Echo  F6Dig   F7LegendF8ActionsF9Sort  F12SpectroCTRL+FSearchp Pause               1/146(0.7%)

This is showing where each process is running. For example, I've got a few minecraft servers. bossmc_forge-1.7.10 is one of those servers, and it's running a JVM that is my server. I've also got a gitlab container and a splunk container, among a few others.

The csysdig command is much closer to top than to ps, but it can do quite a bit more. Overall sysdig has a bit of a learning curve, but I'm finding myself use it more and more over time. Little things like being container aware go a long way to make it into a great tool.