容器调测工具

容器调测工具

现代调测工具的问题现状

调测容器概念

调测镜像制作

实际调测

gdb工具使用案例(用户态调测)

systemtap工具使用案例(内核态调测)

业务容器调测

BBC工具使用案例

调测容器使用场景

3.针对crio容器引擎，采用crictl进行启动

$ cat pod-config.json
{
  "metadata": {
    "name": "debugger",
    "namespace": "default",
    "attempt": 1,
    "uid": "hdishd83djaidwnduwk28bcsb"
  },
  "hostname": "debugger",
  "log_directory": "/tmp",
  "linux": {
    "security_context": {
      "privileged": true,
      "namespace_options": {
        "network": 2,
        "pid": 2
      }
    }
  },
  "mounts": [
    {
      "container_path": "/var/run/crio",
      "host_path": "/var/run/crio",
      "readonly": true
    },
    {
      "container_path": "/lib/modules",
      "host_path": "/lib/modules",
      "readonly": true
    },
    {
      "container_path": "/usr/src/kernels",
      "host_path": "/usr/src/kernels",
      "readonly": true
    }
  ],
  "infra_container": {
    "image": {
      "image": "pause image镜像名称（要修改为你们环境自己使用的pause image）"
    },
    "command": ["/pause"],
    "linux": {
      "security_context": {
        "privileged": true,
        "namespace_options": {
        "network": 2,
        "pid": 2
      }
      }
    }
  }
}

调测容器的json文件内容

$ cat container-config.json
{
  "metadata": {
    "name": "debugger-container"
  },
  "image": {
    "image": "带有调测工具的镜像名称"
  },
  "command": [
     "/bin/sh", "-c", "while true; do sleep 1; done"
  ],
  "mounts": [
    {
      "container_path": "/var/run/crio",
      "host_path": "/var/run/crio",
      "readonly": true
    },
    {
      "container_path": "/lib/modules",
      "host_path": "/lib/modules",
      "readonly": true
    },
    {
      "container_path": "/usr/src/kernels",
      "host_path": "/usr/src/kernels",
      "readonly": true
    }
  ],
  "log_path": "debugger-container.log",
  "linux": {
    "security_context": {
      "privileged": true,
      "namespace_options": {
        "network": 2,
        "pid": 2
      }
    }
  }
}

或者直接以pod的形式在集群中运行

apiVersion: v1
kind: Pod
metadata:
  name: sleep-tool
spec:
  # 指定对应调测镜像运行的节点
  nodeName: g11-u17-cls-worker4
  # 指定该pod与主机共享网络命令空间
  hostNetwork: true
  # 指定该pod与主机共享PID命名空间
  hostPID: true
  containers:
    - name: tool-container
      image: 带有调测工具的镜像名称
      command: ["/bin/sh"]
      args: ["-c", "sleep infinity"]
      securityContext:
        privileged: true
    # 将主机侧文件夹映射到容器内部，与容器共享。
      volumeMounts:
        - name: crio-sock
          mountPath: /var/run
          # 主机侧挂载进来的目录一定要设置为只读，防止篡改主机侧相关文件！
          readOnly: true
        - name: lib-modules
          mountPath: /lib/modules
          readOnly: true
        - name: kernel-headers
          mountPath: /usr/src/kernels
          readOnly: true
  volumes:
    - name: crio-sock
      hostPath:
        path: /var/run
        type: Directory
    - name: lib-modules
      hostPath:
        path: /lib/modules
        type: Directory
    - name: kernel-headers
      hostPath:
        path: /usr/src/kernels
        type: Directory