Docker: any way to list open sockets inside a running docker container?

docker netstat alpine
AdvilUser picture AdvilUser · Oct 31, 2016 · Viewed 62.1k times · Source

I would like to execute netstat inside a running docker container to see open TCP sockets and their statuses. But, on some of my docker containers, netstat is not available. Is there any way to get open sockets (and their statuses, and which IP addresses they are connected to if any) without using netstat, via some docker API? (BTW, my container uses docker-proxy - that is, not directly bridged)

I guess I could look at /proc file system directly, but at that point, I might as well docker cp netstat into the container and execute it. I was wondering if there was any facility that docker might provide for this.

Answer

larsks picture larsks · Nov 1, 2016

You can use the nsenter command to run a command on your host inside the network namespace of the Docker container. Just get the PID of your Docker container:

docker inspect -f '{{.State.Pid}}' container_name_or_id

For example, on my system:

$ docker inspect -f '{{.State.Pid}}' c70b53d98466
15652

And once you have the PID, use that as the argument to the target (-t) option of nsenter. For example, to run netstat inside the container network namespace:

$ sudo nsenter -t 15652 -n netstat
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN

Notice that this worked even though the container does not have netstat installed:

$ docker exec -it c70b53d98466 netstat
rpc error: code = 13 desc = invalid header field value "oci runtime error: exec failed: container_linux.go:247: starting container process caused \"exec: \\\"netstat\\\": executable file not found in $PATH\"\n"

(nsenter is part of the util-linux package)

Related questions

Docker and netstat: netstat is not showing ports, exposed by docker containers

I expose docker ports of my contaners to the host machine with something like docker run -p 80:80 ... then I try to display all listening ports for debugging purposes with netstat e.g.: netstat -at Strange thing is that netstat won't …

Read More
Installing netstat on docker linux container

I want to install netstat on my Docker container. I looked here https://askubuntu.com/questions/813579/netstat-or-alternative-in-docker-ubuntu-server-16-04-container so I'm trying to install it like this: apt-get install net-tools However, I'm getting: Reading package lists... Done Building dependency tree …

Read More
How to get a Docker container's IP address from the host

Is there a command I can run to get the container's IP address right from the host after a new container is created? Basically, once Docker creates the container, I want to roll my own code deployment and container configuration …

Read More