Identify processes running inside Docker, in Process List

I realize that processes that run inside Docker containers appear on the hosts' process list:

# ps aux | grep mariadb
root     12486  0.0  0.0 112812   976 pts/0    S+   14:47   0:00 grep --color=auto mariadb

Is there a way to identify whether a process is running on the Host or on a Docker container, or a way to filter the Docker processes out?

Solution 1:

If I quickly want to see what processes were started by what, I typically use a tool like htop (in tree mode by pressing F5), or pstree.

The output from pstree will look a bit like this:

systemd─┬─VGAuthService
        ├─abrt-dbus───3*[{abrt-dbus}]
        ├─abrt-watch-log
        ├─abrtd
        ├─chronyd
        ├─crond
        ├─dockerd─┬─docker-containe─┬─4*[docker-containe─┬─pause]
        │         │                 │                    └─9*[{docker-containe}]]
        │         │                 ├─docker-containe─┬─kube-apiserver───16*[{kube-apiserver}]
        │         │                 │                 └─9*[{docker-containe}]
        │         │                 ├─docker-containe─┬─kube-scheduler───14*[{kube-scheduler}]
        │         │                 │                 └─10*[{docker-containe}]
        │         │                 ├─docker-containe─┬─kube-controller───13*[{kube-controller}]
        │         │                 │                 └─10*[{docker-containe}]
        │         │                 ├─4*[docker-containe─┬─pause]
        │         │                 │                    └─10*[{docker-containe}]]
        │         │                 ├─docker-containe─┬─kube-proxy───12*[{kube-proxy}]
        │         │                 │                 └─9*[{docker-containe}]
        │         │                 ├─docker-containe─┬─node_exporter───31*[{node_exporter}]
        │         │                 │                 └─10*[{docker-containe}]
        │         │                 └─29*[{docker-containe}]
        │         └─47*[{dockerd}]

Which easily shows what processes are started by what.

htop lives within the in EPEL Repo, on RHEL.
pstree is installed by the psmisc package.

This isn't the most technical answer, but the best answer seems to already exist in a comment.

Solution 2:

Found the answer.

To filter processes that are not running in Docker processes, we can use this:

ps -e -o pid,comm,cgroup | grep -v "/docker/"

So, for example, if I want to kill all "php-fpm" processes that are not running inside Docker, I can do:

kill -9 $(ps -e -o pid,comm,cgroup | grep -v "/docker/" | awk '$2 == "php-fpm" {print $1}')