Using snapshot process

    The snapshot process gadget gathers information about running processes.

    On Kubernetes

    Let’s start this demo by creating a namespace:

    $ kubectl create ns demo
    namespace/demo created
    

    There is not any running process in the demo namespace now:

    $ kubectl gadget snapshot process -n demo
    NODE    NAMESPACE    POD    CONTAINER    COMM    PID
    

    Create a pod on the demo namespace using the nginx image:

    $ kubectl -n demo run mypod --image=nginx
    pod/mypod created
    $ kubectl wait -n demo --for=condition=ready pod/mypod
    pod/mypod condition met
    

    After the pod is running, we can try to get the list of running processes again:

    $ kubectl gadget snapshot process -n demo
    NODE        NAMESPACE    POD      CONTAINER    COMM     PID
    minikube    demo         mypod    mypod        nginx    582294
    minikube    demo         mypod    mypod        nginx    582333
    minikube    demo         mypod    mypod        nginx    582334
    minikube    demo         mypod    mypod        nginx    582335
    minikube    demo         mypod    mypod        nginx    582336
    minikube    demo         mypod    mypod        nginx    582337
    minikube    demo         mypod    mypod        nginx    582338
    minikube    demo         mypod    mypod        nginx    582339
    minikube    demo         mypod    mypod        nginx    582340
    

    We can see the different nginx process started within the container.

    Execute an instance of sleep on the pod:

    $ kubectl -n demo exec  mypod -- /bin/sh -c "sleep 1000 &"
    

    Now there is an additional sleep processes running in mypod:

    $ kubectl gadget snapshot process -n demo
    NODE        NAMESPACE    POD      CONTAINER    COMM     PID
    minikube    demo         mypod    mypod        nginx    582294
    minikube    demo         mypod    mypod        nginx    582333
    minikube    demo         mypod    mypod        nginx    582334
    minikube    demo         mypod    mypod        nginx    582335
    minikube    demo         mypod    mypod        nginx    582336
    minikube    demo         mypod    mypod        nginx    582337
    minikube    demo         mypod    mypod        nginx    582338
    minikube    demo         mypod    mypod        nginx    582339
    minikube    demo         mypod    mypod        nginx    582340
    minikube    demo         mypod    mypod        sleep    584294
    

    Delete the demo test namespace:

    $ kubectl delete ns demo
    namespace "demo" deleted
    

    With local-gadget

    Create a container that runs sleep inside:

    $ docker run --name test-snapshot-process -it --rm busybox /bin/sh -c 'sleep 100'
    

    Run the snapshot process gadget, it’ll print all process in the container:

    $ sudo ./local-gadget snapshot process -c test-snapshot-process
    CONTAINER             COMM  PID
    test-snapshot-process sleep 100003