github.com/inspektor-gadget/inspektor-gadget@v0.28.1/docs/builtin-gadgets/snapshot/process.md (about)

     1  ---
     2  title: 'Using snapshot process'
     3  weight: 20
     4  description: >
     5    Gather information about running processes.
     6  ---
     7  
     8  ![Screencast of snapshot process compared to calling kubectl exec ps](process.gif)
     9  
    10  The snapshot process gadget gathers information about running processes.
    11  
    12  ### On Kubernetes
    13  
    14  Let's start this demo by creating a namespace:
    15  
    16  ```bash
    17  $ kubectl create ns demo
    18  namespace/demo created
    19  ```
    20  
    21  There is not any running process in the `demo` namespace now:
    22  
    23  ```bash
    24  $ kubectl gadget snapshot process -n demo
    25  K8S.NODE            K8S.NAMESPACE       K8S.POD             K8S.CONTAINER       COMM       PID       UID       GID
    26  ```
    27  
    28  Create a pod on the `demo` namespace using the `nginx` image:
    29  
    30  ```bash
    31  $ kubectl -n demo run mypod --image=nginx
    32  pod/mypod created
    33  $ kubectl wait -n demo --for=condition=ready pod/mypod
    34  pod/mypod condition met
    35  ```
    36  
    37  After the pod is running, we can try to get the list of running processes again:
    38  
    39  ```bash
    40  $ kubectl gadget snapshot process -n demo
    41  K8S.NODE            K8S.NAMESPACE       K8S.POD             K8S.CONTAINER       COMM       PID       UID       GID
    42  ubuntu-hirsute      demo                mypod               mypod               nginx      411928    0         0
    43  ubuntu-hirsute      demo                mypod               mypod               nginx      411964    101       101
    44  ubuntu-hirsute      demo                mypod               mypod               nginx      411965    101       101
    45  ubuntu-hirsute      demo                mypod               mypod               nginx      411966    101       101
    46  ubuntu-hirsute      demo                mypod               mypod               nginx      411967    101       101
    47  ubuntu-hirsute      demo                mypod               mypod               nginx      411968    101       101
    48  ubuntu-hirsute      demo                mypod               mypod               nginx      411969    101       101
    49  ubuntu-hirsute      demo                mypod               mypod               nginx      411970    101       101
    50  ubuntu-hirsute      demo                mypod               mypod               nginx      411971    101       101
    51  ```
    52  
    53  We can see the different `nginx` process started within the container.
    54  
    55  Execute an instance of `sleep` on the pod:
    56  
    57  ```bash
    58  $ kubectl -n demo exec mypod -- /bin/sh -c "sleep 1000 &"
    59  ```
    60  
    61  Now there is an additional `sleep` processes running in `mypod`:
    62  
    63  ```bash
    64  $ kubectl gadget snapshot process -n demo
    65  K8S.NODE            K8S.NAMESPACE       K8S.POD             K8S.CONTAINER       COMM       PID       UID       GID
    66  ubuntu-hirsute      demo                mypod               mypod               nginx      411928    0         0
    67  ubuntu-hirsute      demo                mypod               mypod               nginx      411964    101       101
    68  ubuntu-hirsute      demo                mypod               mypod               nginx      411965    101       101
    69  ubuntu-hirsute      demo                mypod               mypod               nginx      411966    101       101
    70  ubuntu-hirsute      demo                mypod               mypod               nginx      411967    101       101
    71  ubuntu-hirsute      demo                mypod               mypod               nginx      411968    101       101
    72  ubuntu-hirsute      demo                mypod               mypod               nginx      411969    101       101
    73  ubuntu-hirsute      demo                mypod               mypod               nginx      411970    101       101
    74  ubuntu-hirsute      demo                mypod               mypod               nginx      411971    101       101
    75  ubuntu-hirsute      demo                mypod               mypod               sleep      412550    0         0
    76  ```
    77  
    78  Delete the demo test namespace:
    79  
    80  ```bash
    81  $ kubectl delete ns demo
    82  namespace "demo" deleted
    83  ```
    84  
    85  ### With `ig`
    86  
    87  Create a container that runs sleep inside:
    88  
    89  ```bash
    90  $ docker run --name test-snapshot-process -it --rm busybox /bin/sh -c 'sleep 100'
    91  ```
    92  
    93  Run the snapshot process gadget, it'll print all process in the container:
    94  
    95  ```bash
    96  $ sudo ig snapshot process -c test-snapshot-process
    97  RUNTIME.CONTAINERNAME                                        COMM             PID                  UID        GID
    98  test-snapshot-process                                        sh               329491               0          0
    99  ```