Repository navigation
fix(debug): make top and logs work without root or a ps binary - #8
Merged
Merged
Conversation
top: the last-resort fallback printed a useless "use /proc/N/root/proc"
placeholder when the image has no ps and nsenter fails (it needs root —
the common case for rootless Podman). It now walks the host /proc process
tree rooted at the container's init PID, which needs no privileges since
/proc/<pid>/status and cmdline are world-readable.
logs: a successful native log API call is now authoritative — a container
that simply hasn't written anything shows "(no log output)" instead of
cascading into fallbacks. The nsenter fallback also no longer returns its
own stderr ("nsenter: cannot open /proc/...: Permission denied") as if it
were log content.
README: bump install snippet to v0.1.2.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the dashboard/CLI
topandlogsfailures reported on rootless setups ("check /proc" placeholder, nsenter permission text shown as logs).Why it broke:
toptriesps auxinside the container (absent from slim/distroless images), thennsenter(needs root). The last resort just printed "use /proc/N/root/proc for detailed listing".logsonly accepted non-empty native log output, so quiet containers fell through to annsenter tailfallback — and its stderr (nsenter: cannot open /proc/...: Permission denied) was returned as log content.Fixes:
top: new unprivileged last resort walks the host/procprocess tree rooted at the container's init PID (status/cmdlineare world-readable). Verified live rootless against apausecontainer (no shell, no ps): lists/pausecorrectly.logs: a successful native log API call is authoritative — quiet containers show(no log output); the nsenter fallback never returns its own stderr as logs, and failures name both errors with a needs-root hint.Verification:
go vet+go test -racegreen (new unit tests for the /proc walker); live E2E via tmux against rootless Podman 5.8.4: logs overlay shows(no log output)for a quiet container and real content for a logging one; top overlay lists processes for a ps-less image.🤖 Generated with Claude Code