How to Find Which Kubernetes Pod Created a Process

You’re debugging in production again. You find a process in the output of ps aux, but you need to know which pod created that process.

First, find the process id (PID). The PID is in the second column in the output of ps aux. We’ll call this $PID.

Then execute:

1

nsenter -t $PID -u hostname

Note: this is the same as nsenter --target $PID --uts hostname.

Note: Make sure to run nsenter on the same node as ps aux.

nsenter is a utility for interacting with Linux namespaces. We’re specifying $PID as the process we want to target. For the provided target process id, we want to enter the process’ UTS (UNIX Time-Sharing) namespace. The UTS namespace is responsible for the hostname and domain name. Fortunately, Kubernetes sets a hostname when creating a pod, where the hostname is the pod’s name.

Finally, we execute the hostname command in the process’ UTS namespace.

And we see the Kubernetes pod name printed.

Know an easier way? Let me know on Twitter or LinkedIn!