docker和host之间的PID映射

Question

How docker namespace is different from Host namespace and how the pid can be mapped between these two? Can anyone give me an idea that helps to make easy way of mapping pid's between host n docker using source code?

Answer 1

You can find the mapping in /proc/PID/status file. It contains a line like:

NSpid:  16950   24

Which means that 16950 on the host is 24 inside the container.

Answer 2

As I mentioned in " Running docker securely ":

Currently, Docker uses five namespaces to alter processes view of the system: Process, Network, Mount, Hostname, Shared Memory.

The fact that, by default, as I mentioned in your previous question " Docker Namespace in kernel level " the container pid are isolated from the host (unless you run them with --pid host ) is by design.

If you are using --pid=host , then those container pids are visible from the host, but not easily matched to a particular container, not until issue 10163 and --pid=container:id is resolved.

Update May 2016: issue 10163 and --pid=container:id is actually resolved by PR 22481 for docker 1.12, allowing to join another container's PID namespace.