github/arthas
4
0
Fork 0
mirror of https://github.com/alibaba/arthas.git synced 2026-10-21 04:48:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prettified Code!

Browse Source
This commit is contained in:
hengyunabc
2026-08-14 02:31:32 +00:00
committed by GitHub Action
parent 48f2f3f904
commit a5ecd7a84a
2 changed files with 16 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
site/docs/doc/docker.md
+8 -8
View File
@@ -197,14 +197,14 @@ spec:
目标 HotSpot 支持 root 客户端时，为了覆盖首次 attach、不同权限的临时目录和 `stop` 清理，建议显式保留下面四项 capability。
| 配置或 capability | 用途 |
| --- | --- |
| `shareProcessNamespace: true` | 让 sidecar 能看到应用 JVM 的 PID 和 `/proc/<pid>` |
| `runAsUser: 0` | 在目标 HotSpot 支持 root 客户端时通过跨 UID 校验 |
| `SYS_PTRACE` | 通过 ptrace access check 读取 `/proc/<pid>`，并访问 `/proc/<pid>/root` 和 mount namespace 信息 |
| `KILL` | UID 不同时向尚未启动 attach listener 的 JVM 发送 `SIGQUIT` |
| `DAC_OVERRIDE` | 连接目标用户拥有的 `0600` attach socket，并写入目标容器的临时目录 |
| `CHOWN` | 把复制到目标容器的 Arthas Home 交给目标用户，使 `stop` 可以清理该目录 |
| 配置或 capability | 用途 |
| ----------------------------- | ---------------------------------------------------------------------------------------------- |
| `shareProcessNamespace: true` | 让 sidecar 能看到应用 JVM 的 PID 和 `/proc/<pid>` |
| `runAsUser: 0` | 在目标 HotSpot 支持 root 客户端时通过跨 UID 校验 |
| `SYS_PTRACE` | 通过 ptrace access check 读取 `/proc/<pid>`，并访问 `/proc/<pid>/root` 和 mount namespace 信息 |
| `KILL` | UID 不同时向尚未启动 attach listener 的 JVM 发送 `SIGQUIT` |
| `DAC_OVERRIDE` | 连接目标用户拥有的 `0600` attach socket，并写入目标容器的临时目录 |
| `CHOWN` | 把复制到目标容器的 Arthas Home 交给目标用户，使 `stop` 可以清理该目录 |
下面是跨 UID 场景的 `securityContext` 片段。它不需要 `privileged: true`、`SYS_ADMIN`、`hostPID` 或 `hostPath`。
site/docs/en/doc/docker.md
+8 -8
View File
@@ -197,14 +197,14 @@ If the sidecar and application JVM use different UIDs, the sidecar must run as U
When the target HotSpot accepts a root client, explicitly retain the following four capabilities to support the initial attach, temporary directories with restrictive permissions, and cleanup by `stop`.
| Setting or capability | Purpose |
| --- | --- |
| `shareProcessNamespace: true` | Makes the application JVM's PID and `/proc/<pid>` visible to the sidecar |
| `runAsUser: 0` | Passes the cross-UID check when the target HotSpot accepts root clients |
| `SYS_PTRACE` | Passes ptrace access checks for `/proc/<pid>`, `/proc/<pid>/root`, and mount namespace information |
| `KILL` | Sends `SIGQUIT` across UIDs when the target JVM's attach listener has not started |
| `DAC_OVERRIDE` | Connects to the target user's `0600` attach socket and writes to the target container's temporary directory |
| `CHOWN` | Gives the copied Arthas Home to the target user so that `stop` can remove it |
| Setting or capability | Purpose |
| ----------------------------- | ----------------------------------------------------------------------------------------------------------- |
| `shareProcessNamespace: true` | Makes the application JVM's PID and `/proc/<pid>` visible to the sidecar |
| `runAsUser: 0` | Passes the cross-UID check when the target HotSpot accepts root clients |
| `SYS_PTRACE` | Passes ptrace access checks for `/proc/<pid>`, `/proc/<pid>/root`, and mount namespace information |
| `KILL` | Sends `SIGQUIT` across UIDs when the target JVM's attach listener has not started |
| `DAC_OVERRIDE` | Connects to the target user's `0600` attach socket and writes to the target container's temporary directory |
| `CHOWN` | Gives the copied Arthas Home to the target user so that `stop` can remove it |
The following `securityContext` fragment is for a cross-UID sidecar. It does not require `privileged: true`, `SYS_ADMIN`, `hostPID`, or `hostPath`.