Container Ops

Container Operations

Overview

Diagnose and troubleshoot containerized applications across Docker and Kubernetes environments. Inspect container state, logs, networking, and resource consumption.

Process

Step 1: Detect Container Runtime

# Check what's available
docker --version 2>/dev/null
podman --version 2>/dev/null
kubectl version --client 2>/dev/null
crictl --version 2>/dev/null

Use whatever is available. Prefer docker for standalone, kubectl for orchestrated.

Step 2: Container Health Overview

Docker:

# All containers with status
docker ps -a --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}\t{{.Image}}"

# Resource usage
docker stats --no-stream --format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.NetIO}}\t{{.BlockIO}}"

# Disk usage
docker system df

Kubernetes:

# Pod status across namespaces
kubectl get pods --all-namespaces -o wide

# Nodes status
kubectl get nodes -o wide

# Events (recent issues)
kubectl get events --sort-by='.lastTimestamp' | tail -20

# Resource usage (if metrics-server available)
kubectl top pods --all-namespaces 2>/dev/null
kubectl top nodes 2>/dev/null

Step 3: Inspect Problematic Container

Docker - container details:

# Full inspection
docker inspect [container]

# Logs (last 100 lines)
docker logs --tail 100 [container]

# Logs with timestamps (last 30 min)
docker logs --since 30m --timestamps [container]

# Process list inside container
docker top [container]

# Resource limits
docker inspect --format '{{.HostConfig.Memory}} {{.HostConfig.NanoCpus}}' [container]

Kubernetes - pod details:

# Pod description (events, conditions)
kubectl describe pod [pod] -n [namespace]

# Logs
kubectl logs [pod] -n [namespace] --tail=100

# Previous container logs (if restarted)
kubectl logs [pod] -n [namespace] --previous

# Multi-container pod
kubectl logs [pod] -n [namespace] -c [container]

# Resource requests/limits
kubectl get pod [pod] -n [namespace] -o jsonpath='{.spec.containers[*].resources}'

Step 4: Container Networking

Docker networking:

# List networks
docker network ls

# Inspect network (connected containers, IPs)
docker network inspect [network]

# Container IP and ports
docker inspect --format '{{.NetworkSettings.IPAddress}} {{.NetworkSettings.Ports}}' [container]

# DNS resolution inside container
docker exec [container] nslookup [hostname] 2>/dev/null || docker exec [container] cat /etc/resolv.conf

# Connectivity test from inside
docker exec [container] wget -qO- --timeout=5 [url] 2>&1 || docker exec [container] curl -s --max-time 5 [url]

Kubernetes networking:

# Service endpoints
kubectl get svc --all-namespaces
kubectl get endpoints [service] -n [namespace]

# DNS resolution from pod
kubectl exec [pod] -n [namespace] -- nslookup [service]

# Network policies
kubectl get networkpolicies --all-namespaces

# Ingress rules
kubectl get ingress --all-namespaces

Step 5: Image and Build Issues

# Image details
docker image inspect [image] | jq '.[0] | {Size, Created, Config: .Config.Cmd}'

# Image layers (find bloat)
docker history [image] --format "table {{.Size}}\t{{.CreatedBy}}" --no-trunc

# Dangling images (wasted space)
docker images -f "dangling=true"

# Unused volumes
docker volume ls -f "dangling=true"

Step 6: Common Issues Checklist

Step 7: Present Report

## Container Diagnostics Report

### Environment
- Runtime: [Docker/Podman/K8s]
- Version: [version]
- Total containers: [N running / M total]

### Issues Found
| Container/Pod | Status | Issue | Severity |
|---------------|--------|-------|----------|
| [name] | [status] | [issue] | [CRITICAL/WARNING] |

### Resource Usage
| Container | CPU | Memory | Net I/O |
|-----------|-----|--------|---------|
| [name] | [%] | [used/limit] | [in/out] |

### Root Cause
[Analysis based on findings]

### Recommendations
1. [Action item]
2. [Action item]

Rules

• NEVER delete containers or images without explicit permission
• NEVER exec into production containers to modify files
• ALWAYS check if the user means Docker or Kubernetes when ambiguous
• For K8s, always specify namespace to avoid confusion
• If kubectl requires auth you don't have, inform the user
• Read-only operations only; suggest fixes but don't apply without permission