Using ksniff on microk8s (containerd container runtime) about ksniff HOT 8 CLOSED

Hi @mudged,

Thank you for using ksniff!

You are right, at the moment the privileged mode is only work with a k8s running with a docker runtime.
We do plan to support other container runtimes, see #36

I'm evaluating the new support for debug containers which might resolve this issue once and for all.

As a possible workaround, you can try the non-privileged mode if it's possible in your situation.

from ksniff.

Hi @eldadru,

Thanks for your response. Unfortunately in my scenario I cannot run in non-privileged mode as the target containers run with a restricted user.

from ksniff.

👍

from ksniff.

Hi @eldadru,

I'm evaluating the new support for debug containers which might resolve this issue once and for all.

Do you have an idea of when support for debug containers will be added to ksniff? In other words, will you be waiting for the feature to leave alpha and beta first?

I'm trying to gauge if I should submit a PR for this issue (and #36) or write up a separate solution in the meantime.

Thanks for all the hard work on ksniff so far!

from ksniff.

With the additions of 1f01100 there logic to detect the container runtime based on containerRuntimeVersion field of Node resource. I'm finding that microk8s and k3s both have containerRuntimeVersion: containerd://1.3.... However, microk8s and k3s both use different tools to communicate with container runtime (microk8s uses microk8s.ctr and k3s uses crictl). I'm checking now if there's a tool in common or if there just needs to be a separate set of code for microk8s environments and we need to check more than containerRuntimeVersion to identify the tooling to use later.

from ksniff.

To be clear, it would be good to support both microk8s and k3s through changes for this issue.

from ksniff.

Hi,
I'd like to use ksniff on containerd in privileged mode. Unfortunately, the non-privileged mode is not possible in my situation.
Do you plan to implement this feature soon? Is there any workaround to use ksniff on containerd when the target container runs with a restricted user?

Thanks,
Carmine

from ksniff.

To get it working on MicroK8s in privileged mode I needed to create a wrapper script on the MicroK8s host as /usr/bin/ctr and specify the socket path.

Wrapper script /usr/bin/ctr

#!/bin/bash
if [ "$1" == "-a" ]; then shift 2; fi
exec /snap/bin/microk8s.ctr "$@"

Example command:

kubectl sniff POD -p --socket /var/snap/microk8s/common/run/containerd.sock

from ksniff.