Fixing “ip netns” for docker

So I want to monitor my Jitsi Videobridge to get some useful statistics. The instructions say to enable Videobridge statistics and then grab stuff from port 8080.
Ok, I think I did that, but it did not work. Time to dig into the container network config.
And while I have a lot of network namespaces, they are unknown to ip netns
, as can be seen when asking for a list. When we define a network namespace with ip netns
, it will symlink the assigned name from /var/run/netns/<name>
to /proc/<pid>/ns/net
of the process that leads that namespace.
So these are our container names, we want them as netns names:
# docker ps --format='{{.Names}}'
jitsi-jvb
...
We can turn them into PIDs:
# docker inspect -f '{{.State.Pid}}' jitsi-jvb
3899821
And with that, we can create a mapping script:
#! /bin/bash
names="$(docker ps --format='{{.Names}}')"
for name in $names
do
pid="$(docker inspect -f '{{.State.Pid}}' $name)"
if [ -z "$pid" ]; then echo "Cannot resolve $name"; continue; fi
echo $pid $name
ln -sf /proc/$pid/ns/net "/var/run/netns/$name"
done
Sure enough, I can now ip netns
things:
# ip netns list
influxdb (id: 5)
mosquitto (id: 2)
grafana (id: 0)
z2m (id: 8)
mqttbridge (id: 9)
jitsi-web (id: 3)
jitsi-prosody (id: 1)
jitsi-jvb (id: 4)
jitsi-jicofo (id: 6)
# ip netns exec jitsi-jvb lsof -i -n -P
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
dockerd 16420 root 134u IPv4 34920699 0t0 UDP 127.0.0.11:45441
dockerd 16420 root 138u IPv4 34920700 0t0 TCP 127.0.0.11:34251 (LISTEN)
java 3900157 docker 152u IPv4 34917278 0t0 UDP 172.3.0.5:10000
java 3900157 docker 153u IPv4 34927830 0t0 TCP 172.3.0.5:59998->172.3.0.2:5222 (ESTABLISHED)
java 3900157 docker 157u IPv4 34927885 0t0 UDP *:5000
java 3900157 docker 159u IPv6 34927887 0t0 UDP *:5000
@ascii158 points me at
console# nsenter -n -t $(docker inspect <containername> -f '{{.State.Pid}}') lsof -i -n -P
as an alternative solution. That works, but is also quite a lot to type. Like the former solution it needs a script, just a different one. It still is more flexible: works with non-network namespaces and does not need to update a static lookup table.
It also highlights the fact that docker ps
prints a lot of different identifiers, none of which are the actual PID. Which is funny, because that is kind of the point of a thing called ps
, isn’t it?