On this page in the Kubernetes docs Pods, it states
The context of the pod can be defined as the conjunction of several Linux namespaces:
PID namespace (applications within the pod can see each other's processes) network namespace (applications within the pod have access to the same IP and port space)
IPC namespace (applications within the pod can use SystemV IPC or POSIX message queues to communicate)
UTS namespace (applications within the pod share a hostname)
However, it then says that
In terms of Docker constructs, a pod consists of a colocated group of Docker containers with shared volumes. PID namespace sharing is not yet implemented with Docker.
So does this mean that pods cannot see processes in other containers or perform any kind of IPC between containers running in the same pod? How would I send a signal to a process running in another pod?
Containers in a pod can use sysV shared memory (shmget() shmat()) and (once docker supports it properly) POSIX shared memory. The only things we can't do are signal() and ptrace() and see processes in /proc
Recent Kubernetes 1.12 (Q3 2018) announcements do include:
See kubernetes/feature 495 "Configurable Pod Process Namespace Sharing" (and its PR 66507, commit 8ebc84e), and its documentation: "Share Process Namespace between Containers in a Pod".
Warning, with this:
If shareProcessNamespace attribute in the Pod specification is set to true, all the containers in a POD share the PID namespace. Hence a process in one container can send signals to the processes in another container.
https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#pod-v1-core
That is exactly what is meant by "PID namespace sharing is not yet implemented with Docker". Kubernetes "pods" are just collections of Docker containers, so if you can't do it in straight Docker you can't do it in Kubernetes.
The containers in a pod do share a network namespace, so you can bind a listening socket to
localhost
and access it from any of the containers in the pod. Possibly this can be used for inter-container ipc/signalling.Yeah, we wish that they could share the PID namespace, but as you say, it is not currently supported by Docker. Once we have support in Docker, we will rapidly add it to Kubernetes.
This means that you can't use signal to signal other processes in the Pod.
You can, however, use IPC mechanisms like pipes and shared memory.