How to determine if a process runs inside lxc/Docker?
Question
Is there any way to determine if a process (script) runs inside an lxc container (~ Docker runtime)? I know that some programs are able to detect whether they run inside a virtual machine, is something similar available for lxc/docker?
Solution
The most reliable way is to check /proc/1/cgroup
. It will tell you the control groups of the init process, and when you are not in a container, that will be /
for all hierarchies. When you are inside a container, you will see the name of the anchor point. With LXC/Docker containers, it will be something like /lxc/<containerid>
or /docker/<containerid>
respectively.
OTHER TIPS
Docker creates a .dockerenv
file at the root of the directory tree inside container.
You can run this script to verify
#!/bin/bash
if [ -f /.dockerenv ]; then
echo "I'm inside matrix ;(";
else
echo "I'm living in real world!";
fi
MORE:
Ubuntu actually has a bash script: /bin/running-in-container
and it actually can return the type of container it has been invoked in. Might be helpful.
Don't know about other major distros though.
On a new ubuntu 16.04 system, new systemd & lxc 2.0
sudo grep -qa container=lxc /proc/1/environ
A concise way to check for docker in a bash script is:
#!/bin/bash
if grep docker /proc/1/cgroup -qa; then
echo I'm running on docker.
fi
Handy Python function to check if running in Docker:
def in_docker():
""" Returns: True if running in a Docker container, else False """
with open('/proc/1/cgroup', 'rt') as ifh:
return 'docker' in ifh.read()
We use the proc's sched (/proc/$PID/sched) to extract the PID of the process. The process's PID inside the container will differ then it's PID on the host (a non-container system).
For example, the output of /proc/1/sched on a container will return:
root@33044d65037c:~# cat /proc/1/sched | head -n 1
bash (5276, #threads: 1)
While on a non-container host:
$ cat /proc/1/sched | head -n 1
init (1, #threads: 1)
This helps to differentiate if you are in a container or not.
The easiest way would be to check the environment. If you have the container=lxc
variable, you are within a container.
Otherwise, if you are root, you can try to perform mknod
or mount
operation, if it fails, you are most likely in a container with dropped capabilities.
Check for all the solutions above in Python:
import os
import subprocess
def in_container():
# type: () -> bool
""" Determines if we're running in an lxc/docker container. """
out = subprocess.check_output('cat /proc/1/sched', shell=True)
out = out.decode('utf-8').lower()
checks = [
'docker' in out,
'/lxc/' in out,
out.split()[0] not in ('systemd', 'init',),
os.path.exists('/.dockerenv'),
os.path.exists('/.dockerinit'),
os.getenv('container', None) is not None
]
return any(checks)
My answer only applies for Node.js processes but may be relevant for some visitors who stumble to this question looking for a Node.js specific answer.
I had the same problem and relying on /proc/self/cgroup
I created an npm package for solely this purpose — to detect whether a Node.js process runs inside a Docker container or not.
The containerized npm module will help you out in Node.js. It is not currently tested in Io.js but may just as well work there too.
Docker is evolving day by day, so we can't say for sure if they are going to keep .dockerenv .dockerinit
in the future.
In most of the Linux flavours init
is the first process to start. But in case of containers this is not true.
#!/bin/bash
if ps -p1|grep -q init;then
echo "non-docker"
else
echo "docker"
fi
Building on the accepted answer that tests /proc/*/cgroup
..
awk -F: '$3 ~ /^\/$/ {c=1} END{ exit c }' /proc/self/cgroup
So for use in a script or so, a test could be constructed this way.
is_running_in_container() {
awk -F: '$3 ~ /^\/$/{ c=1 } END { exit c }' /proc/self/cgroup
}
if is_running_in_container; then
echo "Aye!! I'm in a container"
else
echo "Nay!! I'm not in a container"
fi
This SO Q&A: "Find out if the OS is running in a virtual environment"; though not the same as the OP's question, it does indeed answer common cases of finding which container you're in (if at all).
In particular, install and read the code of this bash script which seems to work pretty well:
virt-what :
sudo apt install virt-what
I have translated JJC's answer into ruby
def in_docker
File.open('/proc/1/cgroup', 'rt') do |f|
contents = f.read
return contents =~ /docker/i || contents =~ /kubepod/i
end
rescue StandardError => e
p 'Local development'
p e
false
end
Maybe this do the trick:
if [ -z $(docker ps -q) ]; then
echo "There is not process currently running"
else
echo "There are processes running"
fi