OpenShift Determine files written in a container

fatrace

One approach to determining files written in a container is to run fatrace in a privileged container:

1. Add a section to the Containerfile/Dockerfile to compile fatrace, install sudo, and add the main container user to sudoers; for example:

   USER root
   RUN dnf install -y gcc make git sudo && \
     git clone https://github.com/martinpitt/fatrace /usr/local/src/fatrace && \
     cd /usr/local/src/fatrace && make && make install && \
     echo "was ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
   USER was

2. Create a service account to run a privileged container; for example:

   oc create sa privilegedsa

3. Add the service account to the privileged SCC:

   oc adm policy add-scc-to-user privileged -z privilegedsa

4. Modify the Deployment to use the privilegedsa serviceAccount, modify the container to use privileged: true and allowPrivilegeEscalation: true, and change the container to execute a shell script that starts the privileged command in the background using sudo (e.g. fatrace) and then executes the original run command in the image (if you can't easily find the original command, review podman inspect); for example:

   spec:
     template:
       spec:
         serviceAccount: privilegedsa
         containers:
           - securityContext:
               privileged: true
               allowPrivilegeEscalation: true
             command:
               - /bin/sh
             args:
               - '-c'
               - 'printf ''#!/bin/sh\nnohup sudo -E /usr/local/sbin/fatrace -t -f W -c -o /tmp/diag_fatrace_$${HOSTNAME}_$$(date +%%Y%%m%%d_%%H%%M%%S).txt &\nsleep 1\n/usr/bin/env JVM_EXTRA_CMD_ARGS=-Xnoloa /work/start_server.sh\n'' > /tmp/run.sh && chmod a+x /tmp/run.sh && /tmp/run.sh'

5. Exercise the application as much as possible.
6. Download the /tmp/diag* file.
7. Review the output; for example, to list all unique files written to:

   awk '{print $NF;}' *fatrace.txt | sort | uniq

Previous Section (Execute a Script in a Container on Startup in OpenShift) | Next Section (Run a Container with a readOnlyRootFilesystem) | Back to Table of Contents