0

I am trying to run the Docker command below:

docker run -it --net container:some-mongo nicolaka/netshoot tcpdump -qns 0 -X -r mypcap.pcap

The DOS error I get is: "mypcap.pcap: No such file or directory". If I run this command then it works as expected:

docker run -it --net container:some-mongo nicolaka/netshoot tcpdump

What path location is Docker looking at for: mypcap.pcap ?

I have tried docker inspect some-mongo, however this just tells me relative paths.

I have also tried Googling this, however my research tells me that Docker can store images and containers in lots of different places.

How can I find the path that tcpdump is looking at?

It is a Linux container on a Windows host.

w0051977
  • 15,099
  • 32
  • 152
  • 329

3 Answers3

0

Looking path location is specified by WORKDIR.
The default is /.
WORKDIR is specified in Dockerfile.

documents

Supplement

If mypcap.pcap exists in the some-mongo container, it will be as follows.

# e.g. Prerequisites /tmp/mypcap.pcap exists in some-mongo
# copy to host machine.
docker cp some-mongo:/tmp/mypcap.pcap C:¥tmp¥mypcap.pcap 
# mount mypcap.pcap directory.
docker run -it -v C:¥tmp:/opt/tcpdump nicolaka/netshoot tcpdump -qns 0 -X -r /opt/tcpdump/mypcap.pcap
Hiroki Matsumoto
  • 357
  • 4
  • 10
  • There is no WORKDIR defined in the Dockerfile: https://hub.docker.com/r/nicolaka/netshoot/dockerfile – Mihai May 06 '19 at 09:24
  • "tcpdump: truncated dump file; tried to read 4 file header bytes, only got 0" – w0051977 May 06 '19 at 09:29
  • If it is no specification on the alpine side too , it will default to `/` . – Hiroki Matsumoto May 06 '19 at 09:29
  • I think that error is probably a problem with the mypcap.pcap file . – Hiroki Matsumoto May 06 '19 at 09:35
  • Maybe you need root Privilege to run Tcpdump. https://groups.google.com/forum/#!topic/ns-3-users/KRKzuCeRZxY. In that case, use the privileged option.. e.g. `docker run -it --privileged -v C:¥tmp:/opt/tcpdump nicolaka/netshoot tcpdump -qns 0 -X -r /opt/tcpdump/mypcap.pcap` – Hiroki Matsumoto May 06 '19 at 09:42
  • `/opt/tcpdump` is any place. You can specify the location. You should read this [document](https://docs.docker.com/storage/volumes/). – Hiroki Matsumoto May 06 '19 at 09:50
  • Thanks again. It would help to see some step by step instructions starting with the creation of the file here: docker exec -it some-mongo /bin/bash – w0051977 May 06 '19 at 09:56
0

If you run the command that way it will look for it in the "/". But you can give it any path you want by specifying the full path.

You should also map the mpcap file:

docker run -it --net container:some-mongo \
-v $(pwd)/mypcap.pcap:/mypcap.pcap \
nicolaka/netshoot \
tcpdump -qns 0 -X -r mypcap.pcap

or on 1 line:

docker run -it --net container:some-mongo -v $(pwd)/mypcap.pcap:/mypcap.pcap nicolaka/netshoot tcpdump -qns 0 -X -r mypcap.pcap

This maps it from the local directory.

Mihai
  • 9,526
  • 2
  • 18
  • 40
  • docker: Error response from daemon: create $(pwd)/mypcap.pcap: "$(pwd)/mypcap.pcap" includes invalid characters for a local volume name, only "[a-zA-Z0-9][a-zA-Z0-9_.-]" are allowed. If you intended to pass a host directory, use absolute path. – w0051977 May 06 '19 at 09:28
  • This only means you are running on Windows. This is the correct way to do it. I don't know the correct way to get the current working directory in Windows. You should not pass absolute paths and especially not post them here. – Mihai May 06 '19 at 09:42
  • Thanks again. It would help to see some step by step instructions starting with the creation of the file here: docker exec -it some-mongo /bin/bash. – w0051977 May 06 '19 at 09:55
  • It would indeed but that is not part of the question. – Mihai May 06 '19 at 09:58
0

To answer your exact question, we can see when inspecting your image (docker inspect nicolaka/netshoot:latest) that there is no WorkingDir defined. In this case, the default dir is / (see What's the default WORKDIR in docker?). But you have to understand that this is the directory inside the running container, not the directory on your host machine.

Note that the command you used (i.e. docker inspect some-mongo) is not inspecting your actual image/container but the one your have chosen as a base to attach your network.

If I understand well, your file is in your current dir on your local command line. To do what you want, you need to make the mypcap.pcap file available to your container.

There are basically 2 ways to do this depending on your requirements.

Build an extended image

The idea is to extend your base image by copying the file inside it. You will need a Dockerfile for that

FROM nicolaka/netshoot:latest
COPY mypcap.pcap .

Then build the image

docker build . -t myextendedimage:mytag

And launch a container based on the new image

docker run -it --net container:some-mongo myextendedimage:mytag tcpdump -qns 0 -X -r mypcap.pcap

Bind mount your file in your container

In your situation this would probably be my preferred option. Assuming that your pcap file is located in C:\tmp\mypcap.pcap

docker run -it --net container:some-mongo -v C:\tmp\mypcap.pcap:/mypcap.pcap nicolaka/netshoot tcpdump -qns 0 -X -r mypcap.pcap

Note that you can mount this file in the image anywhere you like:

docker run -it --net container:some-mongo -v C:\tmp\mypcap.pcap:/my/random/dir/mypcap.pcap nicolaka/netshoot tcpdump -qns 0 -X -r mypcap.pcap
Zeitounator
  • 38,476
  • 7
  • 53
  • 66
  • What is ? what is myfiles? Thanks. – w0051977 May 06 '19 at 09:35
  • Thanks. It would help to see some step by step instructions starting with the creation of the file here: docker exec -it some-mongo /bin/bash – w0051977 May 06 '19 at 09:55
  • @w0051977 absolute path is absolute path (X:/path/to/file in your case under windows). Regarding the rest, If you are talking about creating the file interactively inside the container under a bash shell, I would never recommend to do that as the file will be lost everytime you recycle the container. – Zeitounator May 06 '19 at 12:33
  • what is myfiles? I believe the file is in the root directory. – w0051977 May 06 '19 at 13:16
  • `myfiles` is a random name to bindmount in your container. You can choose whatever you want or even mount directly in the root directory (`-v \mypcap.pcap:/mypcap.pcap`). Please read the doc about [bind mount](https://docs.docker.com/storage/bind-mounts/) for further details. – Zeitounator May 06 '19 at 14:33
  • Can you run your second command from your answer? I see an error. My research is telling me that it should create the file on the localhost and in the container. Is that right? Thanks again. – w0051977 May 06 '19 at 15:37
  • Where is your `mypcap.pcap` file located exactly ? Be precise. Local windows machine or somewhere else ? What is the absolute path to this file on the given device ? – Zeitounator May 06 '19 at 15:44
  • C:\tmp\mypcap.pcap (this is the windows localhost with docker for windows installed). The container is a linux container. This is a learning exercise – w0051977 May 06 '19 at 15:48
  • `docker run -it --net container:some-mongo -v C:\tmp\mypcap.pcap:/mypcap.pcap nicolaka/netshoot tcpdump -qns 0 -X -r mypcap.pcap` – Zeitounator May 06 '19 at 15:49
  • Thanks. I will try this shortly. Will this create the .ncap in the net shoot container (rather than the some-mongo container)? I assume that the file does not have to exist in neither the container nor the localhost? I.e. your command will create the files? – w0051977 May 06 '19 at 15:52
  • You have all that is needed to try and read more doc if needed. – Zeitounator May 06 '19 at 15:56