在 Ubuntu Docker 容器中运行的进程可以与主机的内核进程通信吗

Question

I have a process running inside the Docker container (base image - Ubuntu 18.04). Is it possible to set up a Netlink socket with the Kernel process of the Host (running Ubuntu 18.04)? What are the ways to achieve this?

Docker Client: Version: 20.10.7

Docker Server: Version: 20.10.7

Answer 1

Can a process running inside Ubuntu Docker container communicate with Kernel process of host

Yes. This happens all the time: all sorts of things like file and network I/O and memory allocation interact with the kernel ("syscalls"), and in Docker the kernel is always the host's kernel (on a native-Linux host).

Is it possible to set up a Netlink socket

Probably not. The Docker environment heavily manages the container's network environment and by default disables most direct management of it (via Linux capabilities ). At least some netlink calls require CAP_NET_ADMIN which your container won't normally have.

In principle it's possible to grant your container additional capabilities , for example with docker run --cap-add=NET_ADMIN . But if you start disabling Docker features like this, and specifically interacting with the kernel is important to you, you might find it more straightforward to run the process directly on the host, rather than isolating it in a container and then attempting to disable the isolation.