CODEWITHSUNDEEP
dockernetstatalpine-linux
AdvilUser
AdvilUser

Reputation: 3442

Docker: any way to list open sockets inside a running docker container?

I would like to execute netstat inside a running docker container to see open TCP sockets and their statuses. But, on some of my docker containers, netstat is not available. Is there any way to get open sockets (and their statuses, and which IP addresses they are connected to if any) without using netstat, via some docker API? (BTW, my container uses docker-proxy - that is, not directly bridged)

I guess I could look at /proc file system directly, but at that point, I might as well docker cp netstat into the container and execute it. I was wondering if there was any facility that docker might provide for this.

Upvotes: 123

Views: 141036

Answers (8)

Muhammad Ibrahim
Muhammad Ibrahim

Reputation: 321

in macos and linux, here is to list all port running inside docker accross all container:

docker ps -q | xargs -n 1 docker port

Upvotes: 1

Surya Chakravarthy Balla
Surya Chakravarthy Balla

Reputation: 1

docker inspect <container_id>

  • Look for "ExposedPorts" in "Config"

Upvotes: -2

Jimmy
Jimmy

Reputation: 172

I tried the other solutions and it didn't work for me by my colleague gave me this solution. Thought I would mention it here for others like me and for me to refer to later lol.

docker exec -it [container name] bash

grep -v “rem_address” /proc/net/tcp

Upvotes: 0

Don Richards
Don Richards

Reputation: 61

If you want them all (all containers) try this.

$ for i in `docker ps -q` ; do sudo nsenter -t $(docker inspect -f '{{.State.Pid}}' $i) -n netstat ; done

Upvotes: 5

Yogesh Yadav
Yogesh Yadav

Reputation: 4745

If you have iproute2 package installed, you can use

sudo nsenter -t $(docker inspect -f '{{.State.Pid}}' container_name_or_id) -n ss

or

sudo nsenter -t $(docker inspect -f '{{.State.Pid}}' container_name_or_id) -n ss -ltu

It will show TCP and UDP

Upvotes: 7

mikatuo
mikatuo

Reputation: 800

The two commands from @larsks answer merged into one-liner - no need to copy-paste the PID(s) (just replace container_name_or_id):

sudo nsenter -t $(docker inspect -f '{{.State.Pid}}' container_name_or_id) -n netstat

Upvotes: 48

Anony
Anony

Reputation: 9

server:docker container ls

CONTAINER ID    IMAGE              COMMAND                  CREATED          STATUS           PORTS       NAMES

80acfa804b59    admirito/gsad:10   "docker-entrypoint.s…"   18 minutes ago   Up 10 minutes    80/tcp      gvmcontainers_gsad_1

Upvotes: -3

larsks
larsks

Reputation: 311238

You can use the nsenter command to run a command on your host inside the network namespace of the Docker container. Just get the PID of your Docker container:

docker inspect -f '{{.State.Pid}}' container_name_or_id

For example, on my system:

$ docker inspect -f '{{.State.Pid}}' c70b53d98466
15652

And once you have the PID, use that as the argument to the target (-t) option of nsenter. For example, to run netstat inside the container network namespace:

$ sudo nsenter -t 15652 -n netstat
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN

Notice that this worked even though the container does not have netstat installed:

$ docker exec -it c70b53d98466 netstat
rpc error: code = 13 desc = invalid header field value "oci runtime error: exec failed: container_linux.go:247: starting container process caused \"exec: \\\"netstat\\\": executable file not found in $PATH\"\n"

(nsenter is part of the util-linux package)

Upvotes: 236

Related Questions