Executing Commands in Container Network Namespaces and High-Performance Metric Collection

program (present in the host system) within any network namespace visible to the current process. This means that your host can enter the network namespace of your containers, but your containers can't access the host or other peer containers. Containers can interact with their sub-containers, though. The exact format of the command is: ```console $ ip netns exec <nsname> <command...> ``` For example: ```console $ ip netns exec mycontainer netstat -i ``` `ip netns` finds the `mycontainer` container by using namespaces pseudo-files. Each process belongs to one network namespace, one PID namespace, one `mnt` namespace, etc., and those namespaces are materialized under `/proc/<pid>/ns/`. For example, the network namespace of PID 42 is materialized by the pseudo-file `/proc/42/ns/net`. When you run `ip netns exec mycontainer ...`, it expects `/var/run/netns/mycontainer` to be one of those pseudo-files. (Symlinks are accepted.) In other words, to execute a command within the network namespace of a container, we need to: - Find out the PID of any process within the container that we want to investigate; - Create a symlink from `/var/run/netns/<somename>` to `/proc/<thepid>/ns/net` - Execute `ip netns exec <somename> ....` Review [Enumerate Cgroups](#enumerate-cgroups) for how to find the cgroup of an in-container process whose network usage you want to measure. From there, you can examine the pseudo-file named `tasks`, which contains all the PIDs in the cgroup (and thus, in the container). Pick any one of the PIDs. Putting everything together, if the "short ID" of a container is held in the environment variable `$CID`, then you can do this: ```console $ TASKS=/sys/fs/cgroup/devices/docker/$CID*/tasks $ PID=$(head -n 1 $TASKS) $ mkdir -p /var/run/netns $ ln -sf /proc/$PID/ns/net /var/run/netns/$CID $ ip netns exec $CID netstat -i ``` ## Tips for high-performance metric collection Running a new process each time you want to update metrics is (relatively) expensive. If you want to collect metrics at high resolutions, and/or over a large number of containers (think 1000 containers on a single host), you don't want to fork a new process each time. Here is how to collect metrics from a single process. You need to write your metric collector in C (or any language that lets you do

This section explains how to execute commands within a container's network namespace using `ip netns exec`. It details the process of finding the container's PID, creating a symlink in `/var/run/netns/`, and then using `ip netns exec` with that symlink. It provides an example script to automate this process using the container's short ID. Finally, it touches on tips for high-performance metric collection, suggesting avoiding forking a new process for each metric update when dealing with a large number of containers.