Dockerコンテナでlsofを使用する方法は?

Dockerコンテナでlsofを使用する方法は?
$ docker run --rm nginx:alpine
$ docker exec --privileged -it `docker ps -q | head -1` sh
/ # apk add strace lsof
/ # strace -fp1 lsof
strace: Process 1 attached
[pid     1] rt_sigsuspend([], 8 <unfinished ...>
[pid   100] execve("/usr/bin/lsof", ["lsof"], 0x7fff9ca1d308 /* 9 vars */) = 0
[pid   100] arch_prctl(ARCH_SET_FS, 0x7f19d2cc8b48) = 0
[pid   100] set_tid_address(0x7f19d2cc8fb0) = 100
[pid   100] brk(NULL)                   = 0x55791ae48000
[pid   100] brk(0x55791ae4a000)         = 0x55791ae4a000
[pid   100] mmap(0x55791ae48000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x55791ae48000
[pid   100] mprotect(0x7f19d2cc5000, 4096, PROT_READ) = 0
[pid   100] mprotect(0x557919b6d000, 4096, PROT_READ) = 0
[pid   100] prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1073741816, rlim_max=1073741816}) = 0
[pid   100] close_range(3, 1073741815, 0) = 0
[pid   100] open("/dev/null", O_RDWR|O_LARGEFILE) = 3
[pid   100] close(3)                    = 0
[pid   100] umask(000)                  = 022
[pid   100] getpid()                    = 100
[pid   100] getgid()                    = 0
[pid   100] getegid()                   = 0
[pid   100] geteuid()                   = 0
[pid   100] getuid()                    = 0
[pid   100] mmap(NULL, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f19d2c2b000
[pid   100] stat("/dev", {st_mode=S_IFDIR|0755, st_size=340, ...}) = 0
[pid   100] open("/", O_RDONLY|O_LARGEFILE) = 3
[pid   100] lseek(3, 1, SEEK_SET)       = 1
[pid   100] lstat("/proc/100/fd/3", {st_mode=S_IFLNK|0500, st_size=64, ...}) = 0
[pid   100] open("/proc/100/fdinfo/3", O_RDONLY|O_LARGEFILE) = 4
[pid   100] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f19d2c2a000
[pid   100] read(4, "pos:\t1\nflags:\t0100000\nmnt_id:\t35"..., 1024) = 47
[pid   100] lseek(4, -40, SEEK_CUR)     = 7
[pid   100] close(4)                    = 0
[pid   100] munmap(0x7f19d2c2a000, 4096) = 0
[pid   100] close(3)                    = 0
[pid   100] open("/proc/mounts", O_RDONLY|O_LARGEFILE) = 3
[pid   100] mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f19d2c2a000
[pid   100] read(3, "overlay / overlay rw,relatime,lo"..., 4088) = 2115
[pid   100] pipe([4, 5])                = 0
[pid   100] pipe([6, 7])                = 0
[pid   100] rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1 RT_2], [], 8) = 0
[pid   100] rt_sigprocmask(SIG_BLOCK, ~[], ~[KILL STOP RTMIN RT_1 RT_2], 8) = 0
[pid   100] fork(strace: Process 101 attached
)                      = 101
[pid   101] gettid()                    = 101
[pid   100] rt_sigprocmask(SIG_SETMASK, ~[KILL STOP RTMIN RT_1 RT_2],  <unfinished ...>
[pid   101] rt_sigprocmask(SIG_SETMASK, ~[KILL STOP RTMIN RT_1 RT_2],  <unfinished ...>
[pid   100] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   101] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   100] rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
[pid   101] rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
[pid   100] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   101] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   100] close(4 <unfinished ...>
[pid   101] close(0 <unfinished ...>
[pid   100] <... close resumed>)        = 0
[pid   101] <... close resumed>)        = 0
[pid   100] close(7 <unfinished ...>
[pid   101] close(1 <unfinished ...>
[pid   100] <... close resumed>)        = 0
[pid   101] <... close resumed>)        = 0
[pid   100] rt_sigprocmask(SIG_UNBLOCK, [RT_1 RT_2],  <unfinished ...>
[pid   101] close(2 <unfinished ...>
[pid   100] <... rt_sigprocmask resumed>NULL, 8) = 0
[pid   101] <... close resumed>)        = 0
[pid   100] rt_sigaction(SIGALRM, {sa_handler=0x557919b5f4b6, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f19d2c78acd},  <unfinished ...>
[pid   101] close(3 <unfinished ...>
[pid   100] <... rt_sigaction resumed>{sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
[pid   101] <... close resumed>)        = 0
[pid   100] setitimer(ITIMER_REAL, {it_interval={tv_sec=0, tv_usec=0}, it_value={tv_sec=15, tv_usec=0}},  <unfinished ...>
[pid   101] close(5 <unfinished ...>
[pid   100] <... setitimer resumed>{it_interval={tv_sec=0, tv_usec=0}, it_value={tv_sec=0, tv_usec=0}}) = 0
[pid   101] <... close resumed>)        = 0
[pid   100] write(5, "\315\364\265\31yU\0\0", 8 <unfinished ...>
[pid   101] close(6 <unfinished ...>
[pid   100] <... write resumed>)        = 8
[pid   101] <... close resumed>)        = 0
[pid   100] write(5, "\2\0\0\0", 4 <unfinished ...>
[pid   101] close(8 <unfinished ...>
[pid   100] <... write resumed>)        = 4
[pid   101] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   100] write(5, "/\0", 2 <unfinished ...>
[pid   101] close(9 <unfinished ...>
[pid   100] <... write resumed>)        = 2
[pid   101] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   100] write(5, "\0\20\0\0", 4 <unfinished ...>
[pid   101] close(10 <unfinished ...>
[pid   100] <... write resumed>)        = 4
[pid   101] <... close resumed>)        = -1 EBADF (Bad file descriptor)
[pid   100] read(6,  <unfinished ...>
[pid   101] close(11)                   = -1 EBADF (Bad file descriptor)
[pid   101] close(12)                   = -1 EBADF (Bad file descriptor)
[pid   101] close(13)                   = -1 EBADF (Bad file descriptor)
[pid   101] close(14)                   = -1 EBADF (Bad file descriptor)
[pid   101] close(15)                   = -1 EBADF (Bad file descriptor)
[pid   101] close(16)                   = -1 EBADF (Bad file descriptor)
[pid   101] close(17)                   = -1 EBADF (Bad file descriptor)
[pid   101] close(18)                   = -1 EBADF (Bad file descriptor)
[pid   101] close(19)                   = -1 EBADF (Bad file descriptor)
...
[pid   101] close(1141630)              = -1 EBADF (Bad file descriptor)
[pid   101] close(1141631)              = -1 EBADF (Bad file descriptor)
[pid   101] close(1141632)              = -1 EBADF (Bad file descriptor)
[pid   101] close(1141633)              = -1 EBADF (Bad file descriptor)
[pid   101] close(1141634)              = -1 EBADF (Bad file descriptor)
[pid   101] close(1141635)              = -1 EBADF (Bad file descriptor)
[pid   101] close(1141636)              = -1 EBADF (Bad file descriptor)
[pid   101] close(1141637)              = -1 EBADF (Bad file descriptor)
[pid   101] close(1141638)              = -1 EBADF (Bad file descriptor)
[pid   101] close(1141639strace: Process 1 detached
strace: Process 100 detached
strace: Process 101 detached
 <detached ...>

動作させる方法はありますか?

答え1

私にもこのようなことが起こりましたが、なぜlsofファイル記述子を閉じなければならないのか分かりません。この問題は、FILENOコンテナまたはプロセスごとにリソース制限を設定することで解決できます。

$ docker run -d --rm --name nginx --ulimit nofile=1024 nginx:alpine

または

$ docker run -d --rm --name nginx nginx:alpine
$ docker exec -it -u root /bin/sh nginx
# ulimit -Sn 1024
# apk add lsof
# lsof

Dockerデーモン設定ファイルまたはコマンドラインでデフォルトの/etc/docker/daemon.jsonリソース制限を設定することもできます。

{
  "default-ulimits": {
    "default-nofile": {
      "Name": "nofile",
      "Soft": 1024,
      "Hard": 65535
    }
  }
}

ulimitオプションについては以下を参照してください。getrlimit(2)ulimit組み込みシェルです。参考ash(1)

関連情報