Seeing is Believing: Debugging with Ephemeral Containers
summary
Ephemeral containers land as a beta feature in Kubernetes 1.23 and let a new container join a running Pod to share network and (optionally) PID/user namespaces; use --target to share the target container’s PID space. Examples use a kind local cluster and require privileged node access or nsenter to inspect namespace files. Ephemeral containers are a Pod subresource (created via the subresource API, mounts need raw API), can be privileged (netshoot + strace/tcpdump), persist status/exit codes in the Pod and disappear only when the Pod restarts.
AI-written summary · about
chapters (17)
- 0:00Start
- 4:11Setup: Kind
- 4:51Setup: Postgres
- 5:07Setup: Check versions
- 6:25Debug without Ephemeral Containers
- 11:33Ephemeral Containers spec
- 12:18Ephemeral Containers status
- 12:50What is a Container?
- 20:14Namespaces on Pod Container (K8s)
- 20:52Namespaces using nsenter
- 21:30Ephemeral Containers: debug
- 23:02Namespaces when using Ephemeral Container...
- 27:43Sub-Resource
- 28:24Custom API calls
- 34:22Namespaces when debug by attaching (slide 40)
- 35:16Linux Namespaces on node (docker) (slide 30)
- 36:47Notes
related talks
36mEphemeral Containers in Action - Running a Go Debugger in Kubernetes - Marvin Beckers
40mUser Namespaces in Kubernetes: Security and Flexibility - Pick Both
35mThe Art of Debugging Inside K8s Environment
23mLife of a Container
34mDebugging at Scale in Production - Deep into Your Containers with Kubectl Debug
40mLocal Ephemeral Storage Resource Management
45mContainers from zero! An overview of cgroup and name-spaces
30mObservability in Kubernetes: Unlocking the Power of eBPF