Docker/Kubernetes Network Diagnostic Tools

Luke Hebert

- 3 minutes read - 478 words

Network troubleshooting in Docker and Kubernetes can get tangled fast. The netshoot container bundles a full set of diagnostic tools into a single image, so you can jump into any container’s or pod’s network namespace and start capturing traffic without installing anything on the target system.

Purpose

Docker and Kubernetes network troubleshooting can become complex. With a proper understanding of how their networking works and the right set of tools, you can isolate and resolve these issues efficiently. The netshoot container provides a powerful collection of networking troubleshooting tools for Docker and Kubernetes environments. Along with the tools, the project includes a set of use-cases that demonstrate real-world diagnostic scenarios.

Network Namespaces

Before diving into the tooling, it helps to understand one key concept: network namespaces. Network namespaces provide isolation of the system resources associated with networking. Docker uses network and other types of namespaces (pid, mount, user, etc.) to create an isolated environment for each container. Everything from interfaces, routes, and IPs is completely isolated within the container’s network namespace.

Kubernetes also uses network namespaces. Kubelet creates a network namespace per pod, where all containers in that pod share the same namespace (eths, IP, tcp sockets, etc.). This is a key difference between Docker containers and Kubernetes pods.

The cool thing about namespaces is that you can switch between them. You can enter a different container’s network namespace and perform troubleshooting on its network stack with tools that aren’t even installed on that container.

Additionally, netshoot can be used to troubleshoot the host itself by using the host’s network namespace. This lets you perform any troubleshooting without installing new packages directly on the host or in your application’s environment.

Example: Tcpdump Binds Container Networks and Outputs a PCAP on the Host

sudo docker run -it --rm --net container:<name> -v /tmp:/data nicolaka/netshoot tcpdump -w /data/test.pcap

Example: Tcpdump in Kubernetes

Use kubectl debug to launch an ephemeral container within the target pod, utilizing the nicolaka/netshoot image. This gives you access to network debugging tools, including tcpdump, within the pod’s network namespace.

Replace <pod-name> with the name of your target pod and <container-name-to-debug> with the name of the container whose network traffic you want to capture.

kubectl debug -it <pod-name> --image=nicolaka/netshoot --target=<container-name-to-debug> -- /bin/bash

Once inside the netshoot container’s shell, use tcpdump to capture network traffic. Specify the desired interface and any filters.

container$ tcpdump -i eth0 -w /tmp/capture.pcap

After capturing the traffic, exit the ephemeral container and copy the generated PCAP file to your local machine using kubectl cp.

Replace <pod-name> with the name of your target pod and <ephemeral-container-name> with the name of the ephemeral container you created (e.g., debugger-xxxxx). The PCAP file will be copied to your current directory as capture.pcap.

kubectl cp <pod-name>:/tmp/capture.pcap ./capture.pcap -c <ephemeral-container-name>

Analyze the PCAP file with your preferred tool (Wireshark, tcpdump, tshark, etc.).

References