The notorious lab6.6 domain review | steps 5-9

eddie.d.lopez

much has been said and explained about this domain review by previous students. so, i'll not be covering any new ground. only giving my take on the situation.

Qs 5-7. simple enough, find, run, and view webguy crashloopbackoff state.

Q8. where the fun begins. as others have noted, there's no straightforward way to "log into the container and find the proper id of the nginx user" in its current state. a different post marked the 'kubectl debug' option as the most likely answer, but in my experience with this, that is not the solution with the webguy container in a crashloopbackoff. you could try:

• kubectl debug -it securityreview --image=busybox --target=webguy
  or

• kubectl debug -it securityreview --image=nicolaka/netshoot --target=webguy

but that will only result in the following "Warning: container debugger-8qvtc: failed to generate container..."

so 'kubectl debug' is NOT the solution for this particular container state.

so if really wanting to get into the original nginx image/container, the only solution is to insert a command block breaking the intended image entrypoint, something like the following:

command: ["bin/sh"]
args: ["-c", "while true; do echo hello; sleep 30; done"]

then one can exec into webguy and run the 'id' command to see the nginx user and group ids. but what does that accomplish? not much with this image, because even with the ids, this image requires root privileges (user id = 0) to run. there's a stackoverflow hack suggested on this forum that can best be described as 'a guy having too much time on his hands' to come up with it. appreciate the effort and willingness to contribute, i suppose.

Q9. so, what is the easiest and most efficient way to "Edit the yaml and re-create the pod such that the pod runs without error."

image: nginxinc/nginx-unprivileged
and
runAsUser: 101

so in the end, i'll not be as critical as others have been about the ambiguity of the lab 6 domain review. because at a minimum, if one tries to get webguy/nginx running in a non-root environment, you will have to wrap your head around everything discussed above.

my 2 cents.

i'd be curious to know if anyone has a method to use 'kubectl debug' to generate a usable container of crashloopbackoff condition.