Edit a File in a Running Kubernetes Pod: a Non-Root Container Case
The Pod web-server in the default namespace
runs a simple web server that serves static files from the /var/www/html directory on port 8080.
Unlike in the Simple Case of this challenge,
the container runs as a non-root user, and the files in /var/www/html belong to root.
Your task is to edit the /var/www/html/index.html file in this container without restarting the app container or recreating the Pod:
- Replace the phrase "Hello World" with the phrase "Hello Labs".
- Add the phrase "Practice for the win!" anywhere in the file.
You can change resources only in the default namespace.
You may change the Pod as long as the app container keeps running.
To see the current page, forward a local port to the Pod with kubectl port-forward and send a request to it:
kubectl port-forward pod/web-server 8080:8080 &
curl localhost:8080
Hint 1
The docker exec command has the --user flag to run a command as another user,
but kubectl exec has no such flag.
Its commands always run as the container's user.
The same applies to kubectl cp, because it runs tar in the container.
Hint 2
An ephemeral container can join a running Pod with its own image and its own user.
The kubectl debug command adds such containers to Pods,
and its --target flag makes the debug container share the process (PID) namespace with another container of the Pod.
In the diagram below, the debug container targets the sidecar container.
In this challenge, the target is the app container.
Hint 3
The kernel shows the root filesystem of every process at /proc/<PID>/root.
If the debug container shares the PID namespace with the app container,
the /proc/<PID>/root path of the web server process leads to the files of the app container.
Hint 4
Getting Permission denied for /proc/<PID>/root in the debug container?
To access the files of a process that runs as another user, the debug container needs the SYS_PTRACE capability, even when it runs as root.
Check which kubectl debug --profile you used.
The default general profile adds SYS_PTRACE, and the baseline profile does not.