Using snapshot process

The snapshot process gadget gathers information about running processes.

On Kubernetes

Let’s start this demo by creating a namespace:

$ kubectl create ns demo
namespace/demo created

There is not any running process in the demo namespace now:

$ kubectl gadget snapshot process -n demo
NODE    NAMESPACE    POD    CONTAINER    COMM    PID

Create a pod on the demo namespace using the nginx image:

$ kubectl -n demo run mypod --image=nginx
pod/mypod created
$ kubectl wait -n demo --for=condition=ready pod/mypod
pod/mypod condition met

After the pod is running, we can try to get the list of running processes again:

$ kubectl gadget snapshot process -n demo
NODE        NAMESPACE    POD      CONTAINER    COMM     PID
minikube    demo         mypod    mypod        nginx    582294
minikube    demo         mypod    mypod        nginx    582333
minikube    demo         mypod    mypod        nginx    582334
minikube    demo         mypod    mypod        nginx    582335
minikube    demo         mypod    mypod        nginx    582336
minikube    demo         mypod    mypod        nginx    582337
minikube    demo         mypod    mypod        nginx    582338
minikube    demo         mypod    mypod        nginx    582339
minikube    demo         mypod    mypod        nginx    582340

We can see the different nginx process started within the container.

Execute an instance of sleep on the pod:

$ kubectl -n demo exec  mypod -- /bin/sh -c "sleep 1000 &"

Now there is an additional sleep processes running in mypod:

$ kubectl gadget snapshot process -n demo
NODE        NAMESPACE    POD      CONTAINER    COMM     PID
minikube    demo         mypod    mypod        nginx    582294
minikube    demo         mypod    mypod        nginx    582333
minikube    demo         mypod    mypod        nginx    582334
minikube    demo         mypod    mypod        nginx    582335
minikube    demo         mypod    mypod        nginx    582336
minikube    demo         mypod    mypod        nginx    582337
minikube    demo         mypod    mypod        nginx    582338
minikube    demo         mypod    mypod        nginx    582339
minikube    demo         mypod    mypod        nginx    582340
minikube    demo         mypod    mypod        sleep    584294

Delete the demo test namespace:

$ kubectl delete ns demo
namespace "demo" deleted

With local-gadget

Create a container that runs sleep inside:

$ docker run --name test-snapshot-process -it --rm busybox /bin/sh -c 'sleep 100'

Run the snapshot process gadget, it’ll print all process in the container:

$ sudo ./local-gadget snapshot process -c test-snapshot-process
CONTAINER             COMM  PID
test-snapshot-process sleep 100003