By using AWS re:Post, you agree to the Terms of Use
/Exec linux command inside a container/

Exec linux command inside a container

0

Hi team, I connected to my envoy container using this command :

aws ecs execute-command --cluster cluster-name --task task-id --container container-name --interactive --command "/bin/sh"

once inside the container I'm trying to execute this Linux command: ps aux

I have this error :

sh: ps: command not found

the version of the distribution inside the envoy container is "

Linux version 4.14.276-211.499.amzn2.x86_64 (mockbuild@ip-xx-x-xx-225) (gcc version 7.3.1 20180712 (Red Hat 7.3.1-13) (GCC)) #1 SMP Wed Apr 27 21:08:48 UTC 2022

I tried to install ps : yum install -y procps

I have this error :

Loaded plugins: ovl, priorities
Could not retrieve mirrorlist http://amazonlinux.default.amazonaws.com/2/core/latest/x86_64/mirror.list error was
14: curl#56 - "Recv failure: Connection reset by peer"


 One of the configured repositories failed (Unknown),
 and yum doesn't have enough cached data to continue. At this point the only
 safe thing yum can do is fail. There are a few ways to work "fix" this:
     1. Contact the upstream for the repository and get them to fix the problem.

     2. Reconfigure the baseurl/etc. for the repository, to point to a working
        upstream. This is most often useful if you are using a newer
        distribution release than is supported by the repository (and the
        packages for the previous distribution release still work).

     3. Run the command with the repository temporarily disabled
            yum --disablerepo=<repoid> ...

     4. Disable the repository permanently, so yum won't use it by default. Yum
        will then just ignore the repository until you permanently enable it
        again or use --enablerepo for temporary usage:

            yum-config-manager --disable <repoid>
        or
            subscription-manager repos --disable=<repoid>

     5. Configure the failing repository to be skipped, if it is unavailable.
        Note that yum will try to contact the repo. when it runs most commands,
        so will have to try and fail each time (and thus. yum will be be much
        slower). If it is a very temporary problem though, this is often a nice
        compromise:

            yum-config-manager --save --setopt=<repoid>.skip_if_unavailable=true

Cannot find a valid baseurl for repo: amzn2-core/2/x86_64

is there a way to run basic commands inside the envoy container like ps, map...?

Thank you.

1 Answers
0

This fails because those tools are not installed in your container image. It is best practice to not install system tools that are not needed in container images to reduce the attack surface. It is also best practice to handle container images as immutable so you should avoid installing packages in a running container or making any other changes that will be lost whenever the container restarts. That being said, there are use cases when you need additional tools to debug. The best path would be to add the needed tools and package in your image at build time by modifying the Dockerfile (ideally use that only for development, not in production). Which base image did you use? There may be another envoy base image available with those system tools already installed.

answered 12 days ago
  • this the image : public.ecr.aws/appmesh/aws-appmesh-envoy:v1.21.1.0-prod

  • Ok, so you are using AppMesh as a sidecar with your container? Why exactly are you trying to exec some commands in the Envoy container? This image is explicitly built without unnecessary tools to keep it small and reduce the attack surface. As a matter of fact starting with version 1.22 they use Distroless so you don't even have a package manager. You could build your own image with the tools you need to troubleshoot, but should not use it for any production. More info: https://docs.aws.amazon.com/app-mesh/latest/userguide/envoy.html

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions