Permission errors when testing in a Docker container about pyflame HOT 5 CLOSED

The setup we have is pyflame runs on the host with appropriate permissions. It attaches to the specified docker instance on that host & does profiling on that using ptrace. @eklitzke Any idea about the issue?

from pyflame.

Are you using the PID from inside the container, or outside the container? If you're running Pyflame from the host you need the outside PID.

from pyflame.

I am attempting to run Pyflame from inside the container, and using the inside-container PID.

from pyflame.

We normally run pyflame from outside the container, since it's easier for us to deploy that way. That said, what you're trying to do should work. I'll probably get a chance to look into this later this week.

Thanks for the detailed bug report!

from pyflame.

Hi Michael,

The issue is that by default Docker images don't have the SYS_PTRACE capability. If you try to use strace or gdb within a Docker container you'll get the same problem. I found a good article describing the issue, as well as how to enable ptrace, here: http://blog.johngoulah.com/2016/03/running-strace-in-docker/

If you are able to strace other processes within a container, but are not able to run Pyflame, then please re-open this and let me know.

In a future release I will try to add code to Pyflame to detect when yama.ptrace_scope is too restrictive, or when the process does not have the SYS_PTRACE capability so that a better error message can be printed to the console.

Cheers, and tell mstop I say hi :-D.

from pyflame.