Skip to content

Commit 060b924

Browse files
committed
Tweak the share process namespace page
This PR removes the outdated information about very old versions of k8s releases. It also revises the indentation of unordered lists. Some other trivial clarifications of text are applied as well.
1 parent bcc5507 commit 060b924

File tree

1 file changed

+49
-44
lines changed

1 file changed

+49
-44
lines changed

content/en/docs/tasks/configure-pod-container/share-process-namespace.md

Lines changed: 49 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
---
22
title: Share Process Namespace between Containers in a Pod
3-
min-kubernetes-server-version: v1.10
43
reviewers:
54
- verb
65
- yujuhong
@@ -11,64 +10,69 @@ weight: 160
1110

1211
<!-- overview -->
1312

14-
{{< feature-state state="stable" for_k8s_version="v1.17" >}}
15-
1613
This page shows how to configure process namespace sharing for a pod. When
1714
process namespace sharing is enabled, processes in a container are visible
18-
to all other containers in that pod.
15+
to all other containers in the same pod.
1916

2017
You can use this feature to configure cooperating containers, such as a log
2118
handler sidecar container, or to troubleshoot container images that don't
2219
include debugging utilities like a shell.
2320

24-
25-
2621
## {{% heading "prerequisites" %}}
2722

28-
29-
{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
30-
31-
23+
{{< include "task-tutorial-prereqs.md" >}}
3224

3325
<!-- steps -->
3426

3527
## Configure a Pod
3628

37-
Process Namespace Sharing is enabled using the `shareProcessNamespace` field of
38-
`v1.PodSpec`. For example:
29+
Process namespace sharing is enabled using the `shareProcessNamespace` field of
30+
`.spec` for a Pod. For example:
3931

4032
{{< codenew file="pods/share-process-namespace.yaml" >}}
4133

4234
1. Create the pod `nginx` on your cluster:
4335

44-
```shell
45-
kubectl apply -f https://k8s.io/examples/pods/share-process-namespace.yaml
46-
```
36+
```shell
37+
kubectl apply -f https://k8s.io/examples/pods/share-process-namespace.yaml
38+
```
4739

4840
1. Attach to the `shell` container and run `ps`:
4941

50-
```shell
51-
kubectl attach -it nginx -c shell
52-
```
42+
```shell
43+
kubectl attach -it nginx -c shell
44+
```
45+
46+
If you don't see a command prompt, try pressing enter. In the container shell:
47+
48+
```shell
49+
# run this inside the "shell" container
50+
ps ax
51+
```
5352

54-
If you don't see a command prompt, try pressing enter.
53+
The output is similar to this:
5554

56-
```
57-
/ # ps ax
58-
PID USER TIME COMMAND
59-
1 root 0:00 /pause
60-
8 root 0:00 nginx: master process nginx -g daemon off;
61-
14 101 0:00 nginx: worker process
62-
15 root 0:00 sh
63-
21 root 0:00 ps ax
64-
```
55+
```none
56+
PID USER TIME COMMAND
57+
1 root 0:00 /pause
58+
8 root 0:00 nginx: master process nginx -g daemon off;
59+
14 101 0:00 nginx: worker process
60+
15 root 0:00 sh
61+
21 root 0:00 ps ax
62+
```
6563

6664
You can signal processes in other containers. For example, send `SIGHUP` to
67-
nginx to restart the worker process. This requires the `SYS_PTRACE` capability.
65+
`nginx` to restart the worker process. This requires the `SYS_PTRACE` capability.
6866

67+
```shell
68+
# run this inside the "shell" container
69+
kill -HUP 8 # change "8" to match the PID of the nginx leader process, if necessary
70+
ps ax
6971
```
70-
/ # kill -HUP 8
71-
/ # ps ax
72+
73+
The output is similar to this:
74+
75+
```none
7276
PID USER TIME COMMAND
7377
1 root 0:00 /pause
7478
8 root 0:00 nginx: master process nginx -g daemon off;
@@ -77,12 +81,18 @@ PID USER TIME COMMAND
7781
23 root 0:00 ps ax
7882
```
7983

80-
It's even possible to access another container image using the
84+
It's even possible to access the file system of another container using the
8185
`/proc/$pid/root` link.
8286

87+
```shell
88+
# run this inside the "shell" container
89+
# change "8" to the PID of the Nginx process, if necessary
90+
head /proc/8/root/etc/nginx/nginx.conf
8391
```
84-
/ # head /proc/8/root/etc/nginx/nginx.conf
8592

93+
The output is similar to this:
94+
95+
```none
8696
user nginx;
8797
worker_processes 1;
8898
@@ -94,21 +104,19 @@ events {
94104
worker_connections 1024;
95105
```
96106

97-
98-
99107
<!-- discussion -->
100108

101-
## Understanding Process Namespace Sharing
109+
## Understanding process namespace sharing
102110

103111
Pods share many resources so it makes sense they would also share a process
104-
namespace. Some container images may expect to be isolated from other
105-
containers, though, so it's important to understand these differences:
112+
namespace. Some containers may expect to be isolated from others, though,
113+
so it's important to understand the differences:
106114

107-
1. **The container process no longer has PID 1.** Some container images refuse
115+
1. **The container process no longer has PID 1.** Some containers refuse
108116
to start without PID 1 (for example, containers using `systemd`) or run
109117
commands like `kill -HUP 1` to signal the container process. In pods with a
110-
shared process namespace, `kill -HUP 1` will signal the pod sandbox.
111-
(`/pause` in the above example.)
118+
shared process namespace, `kill -HUP 1` will signal the pod sandbox
119+
(`/pause` in the above example).
112120

113121
1. **Processes are visible to other containers in the pod.** This includes all
114122
information visible in `/proc`, such as passwords that were passed as arguments
@@ -118,6 +126,3 @@ containers, though, so it's important to understand these differences:
118126
`/proc/$pid/root` link.** This makes debugging easier, but it also means
119127
that filesystem secrets are protected only by filesystem permissions.
120128

121-
122-
123-

0 commit comments

Comments
 (0)