<p>I have a Kubernetes cluster (Docker and containerd) where I deployed the <a href="https://github.com/weaveworks/weave" rel="nofollow noreferrer">Weave CNI plugin</a>.</p>
<p>When inspecting the master node processes (<code>ps -aef --forest</code>) I can see that the <code>containerd-shim</code> process that runs the weave plugin has 3 processes in it's tree:</p>
<pre><code>31175  16241 \_ containerd-shim -namespace moby -workdir /var/lib/containerd/io.containerd.runtime.v1.linux/moby/836489.. -address /run/containerd/contai
31199  31175 |   \_ /bin/sh /home/weave/launch.sh
31424  31199 |   |   \_ /home/weave/weaver --port=6783 --datapath=datapath --name=36:e4:33:8
31656  31175 |   \_ /home/weave/kube-utils -run-reclaim-daemon -node-name=ubuntu -peer-name=36:e4
</code></pre>
<p>What I fail to understand is how the <code>kube-utils</code> process (pid 31656), which is issued from the <code>launch.sh</code> script process (pid 31199) <strong>is a sibling process of it and not a child process?</strong></p>
<p>I have tried to create a similar environment to emulate this scenario, by creating a docker image from the following:</p>
<pre><code>FROM ubuntu:18.04
ADD ./launch.sh /home/temp/
ENTRYPOINT [&quot;/home/temp/launch.sh&quot;]
</code></pre>
<p>Where <code>launch.sh</code> in my case is similar in the idea to <a href="https://github.com/weaveworks/weave/blob/master/prog/weave-kube/launch.sh" rel="nofollow noreferrer">that of weave</a>:</p>
<pre><code>#!/bin/sh

start() {
    sleep 2000&amp;
}

start &amp;

sleep 4000
</code></pre>
<p>After deploying this to the cluster I get the following process tree:</p>
<pre><code>114944  16241 \_ containerd-shim -namespace moby -workdir /var/lib/containerd/io.containerd.runtime.v1.linux/moby/d9a6904 -address /run/containerd/contai
114972 114944     \_ /bin/sh /home/temp/launch.sh
115002 114972         \_ sleep 4000
115003 114972         \_ sleep 2000

</code></pre>
<p>And you can see that both processes are children of the main container process and not a sibling.</p>
<p><strong>According to the weave scenario above, I would expect that the <code>sleep 2000</code> process would be a sibling to the <code>launch.sh</code> process and not a child.</strong></p>
<p>Any idea how to explain the weave situation above? how can I reproduce this locally? or in what scenario is a sibling process created to the container process?</p>
<p>Thank you all.</p>

omricoco
<blockquote>
<p>According to the weave scenario above, I would expect that the sleep 2000 process would be a sibling to the launch.sh process and not a child.</p>
</blockquote>
<p>I reproduced the setup you were having and encountered similar situation (one of the <code>sleep</code> command was not a sibling to <code>launch.sh</code>). To achieve that you will need following parameters in your <code>Deployment</code> or <code>Pod</code> YAML:</p>
<ul>
<li><code>hostPid</code></li>
<li>
<pre><code>securityContext: 
  privileged: true
</code></pre>
</li>
</ul>
<p>You can read more about <code>hostPid</code> here:</p>
<ul>
<li><em><a href="https://medium.com/@chrispisano/limiting-pod-privileges-hostpid-57ce07b05896" rel="nofollow noreferrer">Medium.com: Limiting pod privileges</a></em></li>
<li><em><a href="https://stackoverflow.com/questions/41977957/what-do-hostpid-and-hostipc-options-mean-in-a-kubernetes-pod">Stackoverflow.com: Questions: What do hostpid and hostipc options mean in a kubernetes pod</a></em></li>
</ul>
<p>You can read more about <code>securityContext</code> here:</p>
<ul>
<li><em><a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">Kubernetes.io: Configure pod container: Security context</a></em></li>
</ul>
<hr />
<p>It's working with <code>Weave</code> as it's having parameters mentioned above. You can look them up here:</p>
<ul>
<li><em><a href="https://github.com/weaveworks/weave/blob/master/prog/weave-kube/weave-daemonset-k8s-1.11.yaml#L180" rel="nofollow noreferrer">Github.com: Weaveworks: weave-daemonset-k8s-1.11.yaml </a></em>:
<ul>
<li>line <code>141</code></li>
<li>line <code>172</code></li>
<li>line <code>180</code></li>
</ul>
</li>
</ul>
<p>Also this processes are running by:</p>
<ul>
<li><em><a href="https://github.com/weaveworks/weave/blob/master/prog/weave-kube/launch.sh#L186" rel="nofollow noreferrer">Github.com: Weaveworks: weave-kube: launch.sh: Line 186</a></em></li>
</ul>
<hr />
<h2>Example</h2>
<p>This is an example to show how you can have a setup where the <code>sleep</code> command will be a sibling to <code>launch.sh</code>.</p>
<p>The process can differ:</p>
<ul>
<li>using <code>ConfigMap</code> with a script as an entrypoint</li>
<li>building an image with all the files included</li>
</ul>
<p><code>launch.sh</code> file:</p>
<pre class="lang-sh prettyprint-override"><code>#!/bin/bash
start() {
    sleep 10030 &amp;
}
start &amp;
( sleep 10040 &amp;)
sleep 10050 &amp;
/bin/sh -c 'sleep 10060'
</code></pre>
<h3>Using <code>ConfigMap</code> with a script as an entrypoint</h3>
<p>You can use above script to create a <code>configMap</code> which will be used to run a pod:</p>
<ul>
<li><code>$ kubectl create cm --from-file=launch.sh</code></li>
</ul>
<p><code>Pod</code> YAML definition:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Pod
metadata:
  labels:
    run: bashtest
  name: bashtest
spec:
  containers:
  - image: ubuntu
    name: bashtest
    command: [&quot;/mnt/launch.sh&quot;]
    resources: {}
    securityContext:
       privileged: true
    volumeMounts:
    - mountPath: /mnt/launch.sh
      name: ep
      subPath: launch.sh
  dnsPolicy: ClusterFirst
  restartPolicy: Always
  hostPID: true
  volumes:
    - name: ep
      configMap:
        defaultMode: 0750
        items:
        - key: launch.sh
          path: launch.sh
        name: entrypoint
</code></pre>
<h3>Building an image with all the files included</h3>
<p>You can also build an image. Please remember that this image is only for <strong>example purposes</strong>.</p>
<p><code>Dockerfile</code>:</p>
<pre><code>FROM ubuntu:18.04
ADD ./launch.sh /
RUN chmod 777 ./launch.sh
ENTRYPOINT [&quot;/launch.sh&quot;]
</code></pre>
<p><code>Pod</code> YAML definition:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Pod
metadata:
  name: process
  labels:
    app: ubuntu
spec:
  containers:
  - image: gcr.io/dkruk-test-00/bashtest
    imagePullPolicy: Always
    name: ubuntu
    securityContext:
       privileged: true
  hostPID: true
  restartPolicy: Always
</code></pre>
<hr />
<p>After applying the manifest for this resources (either with built image or with a <code>ConfigMap</code>), you should be able to run (on a node that is running this <code>Pod</code>):</p>
<ul>
<li><code>$ ps -aef --forest</code></li>
</ul>
<p>and see the output similar to this (only part):</p>
<pre class="lang-sh prettyprint-override"><code>root     2297272     290  0 09:44 ?        00:00:00  \_ containerd-shim -namespace moby -workdir /var/lib/containerd/io.containerd.runtime.v1.linux/moby/5c802039033683464d5a586
root     2297289 2297272  0 09:44 ?        00:00:00      \_ /bin/bash /launch.sh
root     2297306 2297289  0 09:44 ?        00:00:00      |   \_ sleep 10050
root     2297307 2297289  0 09:44 ?        00:00:00      |   \_ /bin/sh -c sleep 10060
root     2297310 2297307  0 09:44 ?        00:00:00      |       \_ sleep 10060
root     2297305 2297272  0 09:44 ?        00:00:00      \_ sleep 10040
root     2297308 2297272  0 09:44 ?        00:00:00      \_ sleep 10030
</code></pre>
