netshoot VS container_builder

Now, let's use netshoot, a Docker image equipped with a set of networking troubleshooting tools that can be used for Docker networking.

nicolaka/netshoot for sure. having a preloaded array of networking troubleshooting tools in an image for kubernetes debugging is a godsend.

First off, it seems like getting tcpdump or Wireshark to capture from the container network and dumping to a file will take some extra steps. (A lot of blog posts seem to recommend this Github project - https://github.com/nicolaka/netshoot)

Some hints how to debug such problems in the future: 1. ufw drops/rejections are logged (use dmesg to view them) 2. wireshark shows all connection attempts, even those that are blocked by firewall 3. ss or netstat shows if the server is actually listening for connections 4. netshoot allows to enter docker container network namespace and do pings, curl or telnet from there

Now that Rocky Linux is GA, here is a repo for a minimal container image for Rocky Linux. Its size is around ~37 MB (compressed). It is based on Fedora Minimal and UBI8 minimal from Red Hat. You can download it from Quay or build it, following the instructions in the repo. You could also generate a new rootfs yourself before building the image, again, following the short instructions in the repo.