If I quickly want to see what processes were started by what, I typically use a tool like htop
(in tree mode by pressing F5), or pstree
.
The output from pstree
will look a bit like this:
systemd─┬─VGAuthService
├─abrt-dbus───3*[{abrt-dbus}]
├─abrt-watch-log
├─abrtd
├─chronyd
├─crond
├─dockerd─┬─docker-containe─┬─4*[docker-containe─┬─pause]
│ │ │ └─9*[{docker-containe}]]
│ │ ├─docker-containe─┬─kube-apiserver───16*[{kube-apiserver}]
│ │ │ └─9*[{docker-containe}]
│ │ ├─docker-containe─┬─kube-scheduler───14*[{kube-scheduler}]
│ │ │ └─10*[{docker-containe}]
│ │ ├─docker-containe─┬─kube-controller───13*[{kube-controller}]
│ │ │ └─10*[{docker-containe}]
│ │ ├─4*[docker-containe─┬─pause]
│ │ │ └─10*[{docker-containe}]]
│ │ ├─docker-containe─┬─kube-proxy───12*[{kube-proxy}]
│ │ │ └─9*[{docker-containe}]
│ │ ├─docker-containe─┬─node_exporter───31*[{node_exporter}]
│ │ │ └─10*[{docker-containe}]
│ │ └─29*[{docker-containe}]
│ └─47*[{dockerd}]
Which easily shows what processes are started by what.
htop
lives within the in EPEL Repo, on RHEL.
pstree
is installed by the psmisc
package.
This isn't the most technical answer, but the best answer seems to already exist in a comment.
cat /proc/PID/cgroup
, where PID is a process' PID on the host, tells you if a given process runs in a Docker container (from blog.stangroome.com/2017/12/05/…).