1

I have a very simple Ubuntu container with apache running into it. When I started the container with:

$ sudo docker run -p 192.168.189.134:80:80 -d wnoorduin/apache

where 192.168.189.134 is my IP-address and look at the processes on the docker host, I see:

$ sudo ps -ef | grep docker root 35701 1 0 13:46 ?
00:00:14 /usr/bin/docker daemon root 37825 35701 0 14:47 ?
00:00:00 docker-proxy -proto tcp -host-ip 192.168.189.134 -host-port 80 -container-ip 172.17.0.2 -container-port 80 root 37946 3465 0 14:53 pts/0 00:00:00 grep --color=auto docker

root@willems-vm:/# ps -ef | grep apache root 37832 35701 0 14:47 ? 00:00:00 /bin/sh /usr/sbin/apache2ctl -D FOREGROUND root
37856 37832 0 14:47 ? 00:00:00 /usr/sbin/apache2 -D FOREGROUND www-data 37857 37856 0 14:47 ? 00:00:00 /usr/sbin/apache2 -D FOREGROUND www-data 37858 37856 0 14:47 ? 00:00:00 /usr/sbin/apache2 -D FOREGROUND root 37950 3465 0 14:54 pts/0
00:00:00 grep --color=auto apache

and:

root@willems-vm:/# ps -efZ | grep docker unconfined
root 35701 1 0 13:46 ? 00:00:14 /usr/bin/docker daemon unconfined root 37825 35701 0 14:47 ?
00:00:00 docker-proxy -proto tcp -host-ip 192.168.189.134 -host-port 80 -container-ip 172.17.0.2 -container-port 80 docker-default
root 37832 35701 0 14:47 ? 00:00:00 /bin/sh /usr/sbin/apache2ctl -D FOREGROUND docker-default
root 37856 37832 0 14:47 ? 00:00:00 /usr/sbin/apache2 -D FOREGROUND docker-default www-data 37857 37856 0 14:47 ? 00:00:00 /usr/sbin/apache2 -D FOREGROUND docker-default www-data 37858 37856 0 14:47 ? 00:00:00 /usr/sbin/apache2 -D FOREGROUND unconfined root 37952 3465 0 14:55 pts/0 00:00:00 grep --color=auto docker

So after putting the Z of SELinux in this, I can confirm the the apache2 process is coming from a docker container. Back in my good days, when I was configuring Solaris Containers, it was actually possible to see the zone-name (this was called a zone) in the ps listing (if I remember, it was also ps -efZ, but Z had a totally different meaning then).

When running one container this is not so disastrous, but when running 10, you cannot track the process down to the container. So: Is there a way to do that on the docker host, without the docker commnd ?

0

The regular old ps command is not docker aware, so it isn't possible to see container names using that.

There is a tool called sysdig that is really quite powerful. It can show lots of different things, and it is container aware.

The only thing that some might consider a drawback is that sysdig requires a kernel module to work. It collects data on what processes are actually doing and can get really meaningful insight into the health and status of anything on a system.

I usually run the csysdig tool to get a curses interactive type tool.

Running sudo csysdig -pc gives me the following view of processes:

Viewing: Processes For: whole machine
Source: Live System Filter: evt.type!=switch
   PID    VPID     CPU USER          TH     VIRT      RES    FILE     NET Container           Command
 27485   27485    2.00 root           1     132M      37M       0    0.00 host                csysdig -pc
 29099       7    0.50 root          18       3G     369M       0    0.00 boss_twilight       java -XX:MaxPermSize=128M
 30969     241    0.50               42       2G     325M       0   2.18K gitlab              sidekiq 3.3.0 gitlab-rails
 30137      93    0.50               52       1G      42M       0  274.50 splunk              mongod --dbpath=/opt/splun
 29236      16    0.50 root          30       3G       1G       0    0.00 bossmc_forge-1.7.10 java -XX:MaxPermSize=128M
 32654       7    0.50 root           1      96M      12M       0  18.84K bossmc_lanannounce  python lanannounce.py
 30965     237    0.50                3      38M       2M      7K  183.50 gitlab              /opt/gitlab/embedded/bin/r
 28597   28597    0.00 root           5     106M     464K       0    0.00 host                /usr/bin/docker-proxy -pro
 31029     270    0.00                1      27M       2M       0    0.00 gitlab              postgres: stats collector
 28542   28542    0.00 root           6     114M     468K       0    0.00 host                /usr/bin/docker-proxy -pro
 28500   28500    0.00 root           5      42M     444K       0    0.00 host                /usr/bin/docker-proxy -pro
 28517   28517    0.00 root           5     106M     580K       0    0.00 host                /usr/bin/docker-proxy -pro
 28366   28366    0.00 root           5      42M     176K       0    0.00 host                /usr/bin/docker-proxy -pro
 17675   17675    0.00 root           1      19M       1M       0    0.00 host                /lib/systemd/systemd-login
 28409   28409    0.00 root           5      42M     420K       0    0.00 host                /usr/bin/docker-proxy -pro
 28634   28634    0.00 root           6      50M     388K       0    0.00 host                /usr/bin/docker-proxy -pro
     1       1    0.00 root           1      28M       3M       0    0.00 host                /lib/systemd/systemd --sys
 31289     282    0.00                1      19M       3M       6    0.00 gitlab              /bin/bash /opt/gitlab/embe
 28613   28613    0.00 root           5     106M     404K       0    0.00 host                /usr/bin/docker-proxy -pro
 30941     223    0.00 root           1       4M       1M       0    0.00 gitlab              runsv logrotate
 29409      12    0.00 root           1      20M      12K       0    0.00 auto-proxy          /bin/bash -c source ".prof
 28643   28643    0.00 root           5     106M     500K       0    0.00 host                /usr/bin/docker-proxy -pro
 31696     353    0.00                2     374M     107M       0    0.00 gitlab              unicorn worker[3] -D -E pr
   668     668    0.00 root           1      14M     180K       0    0.00 host                /sbin/agetty --noclear tty
 30948     230    0.00 root           1       4M     584K       0    0.00 gitlab              svlogd -tt /var/log/gitlab
 28508   28508    0.00 root           6     115M     764K       0    0.00 host                /usr/bin/docker-proxy -pro
   659     659    0.00 root           1       4M     176K       0    0.00 host                /usr/sbin/acpid
F1Help  F2Views F4FilterF5Echo  F6Dig   F7LegendF8ActionsF9Sort  F12SpectroCTRL+FSearchp Pause               1/146(0.7%)

This is showing where each process is running. For example, I've got a few minecraft servers. bossmc_forge-1.7.10 is one of those servers, and it's running a JVM that is my server. I've also got a gitlab container and a splunk container, among a few others.

The csysdig command is much closer to top than to ps, but it can do quite a bit more. Overall sysdig has a bit of a learning curve, but I'm finding myself use it more and more over time. Little things like being container aware go a long way to make it into a great tool.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.