Trace a container process's syscalls from the host
understanding that containers are host processes.
find the host PID via docker inspect or ps, then strace -p that PID from the host, since the container shares the host kernel.
WHAT THIS TESTS It verifies you understand that container isolation is namespaces over a shared kernel, so the host can observe a container process directly without any in-container tooling.
A GOOD ANSWER COVERS The key realization is that the container process is a normal process on the host, just remapped by PID and other namespaces. So you find its host PID with docker inspect --format '{{.State.Pid}}' <container> or docker top <container>, then run strace -p <host_pid> as root on the host. The kernel records syscalls regardless of namespace boundaries. If you need the container's own filesystem and tooling view, use nsenter --target <pid> --all to enter its namespaces while using host binaries. For broader visibility, perf trace or bpftrace can trace syscalls system-wide and filter by PID, which is lower overhead than strace's ptrace.
COMMON WRONG ANSWERS Insisting you must add strace to the image and rebuild. Trying docker exec when the image has no shell or no strace. Forgetting that strace requires CAP_SYS_PTRACE or root, and that the container PID differs from the host PID.
LIKELY FOLLOW-UPS Why is the in-container PID different from the host PID? What is the overhead of ptrace versus eBPF tracing? How does nsenter differ from docker exec?
ONE CONCRETE EXAMPLE A scratch-based Go service hangs. docker inspect shows .State.Pid is 48213. From the host you run strace -f -p 48213 and see it blocked on a futex waiting on a connection that never resolves, pinpointing a deadlock without ever touching the minimal image.
Interview question
Why can the host run strace against a container process even though strace is absent from the container image?
- a.Docker injects strace into every running container automatically
- b.strace runs in userspace and needs no kernel cooperation
- c.The container shares the host kernel, so the host PID can be traced directlyCorrect
- d.The minimal image still ships a hidden strace binary
Why? this is the answer
Containers are host processes under a shared kernel, so tracing the mapped host PID works from outside; nothing is injected into the image and strace is not hidden inside it.
Just read this? Test yourself on what you have been reading.
Read the original → oneuptime.com
- #debugging
- #strace
- #namespaces
- #nsenter
- #kernel
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on debugging — each one lists the topics its interview covers.
See open roles