[root@localhost nmx]# execsnoop -r -t Tracing exec()s. Ctrl-C to end. ERROR: ftrace may be in use by PID 5274 /var/tmp/.ftrace-lock [root@localhost nmx]# rm -rf /var/tmp/.ftrace-lock [root@localhost nmx]# execsnoop -r -t Tracing exec()s. Ctrl-C to end. Instrumenting stub_execve TIMEs PID PPID ARGS 1530.092259 5650 5648 cat -v trace_pipe 1530.092260 5649 5645 gawk -v o=1 -v opt_name=0 -v name= -v opt_duration=0 [...] 1545.580098 5651 5249 nerdctl run -d --runtime=io.containerd.runc.v2-rs busybox sleep 1000 1545.797659 5657 5314 /usr/local/bin/containerd-shim-runc-v2-rs -namespace default -address /run/containerd/containerd.sock -publish-binary /usr/local/bin/containerd -id 243cd30d3773ae85b803721ab61a83d5529a16edcfa39c009ee8aefceb24ba98 [...] 1545.853975 5658 5657 /usr/local/bin/containerd-shim-runc-v2-rs -namespace default -id 243cd30d3773ae85b803721ab61a83d5529a16edcfa39c009ee8aefceb24ba98 -address /run/containerd/containerd.sock 1545.892530 5678 5670 /usr/local/bin/runc --root /run/containerd/runc/default --log /run/containerd/io.containerd.runtime.v2.task/default/243cd30d3773ae85b803721ab61a83d5529a16edcfa39c009ee8aefceb24ba98/log.json --log-format json create --bundle [...] 1545.909185 5684 5681 /usr/local/bin/runc init 1545.914602 5684 5681 /usr/local/bin/runc init 1545.947952 5693 5683 /usr/local/bin/nerdctl internal oci-hook createRuntime 1545.982165 5699 5695 /usr/local/libexec/cni/bridge 1545.990552 5705 5692 /usr/lib/systemd/systemd-sysctl --prefix=/net/ipv4/conf/veth1b955ecc --prefix=/net/ipv4/neigh/veth1b955ecc --prefix=/net/ipv6/conf/veth1b955ecc --prefix=/net/ipv6/neigh/veth1b955ecc 1545.992633 5706 5699 /usr/local/libexec/cni/host-local 1546.006456 5713 5699 /usr/sbin/iptables --version 1546.008731 5714 5699 /usr/sbin/iptables -t nat -S --wait 1546.011693 5715 5699 /usr/sbin/iptables -t nat -N CNI-f7bdb61044a7824a7beae631 --wait 1546.014617 5716 5699 /usr/sbin/iptables -t nat -C CNI-f7bdb61044a7824a7beae631 -d 10.4.0.7/24 -j ACCEPT [...] 1546.016578 5717 5699 /usr/sbin/iptables -t nat -A CNI-f7bdb61044a7824a7beae631 -d 10.4.0.7/24 -j ACCEPT [...] 1546.018775 5718 5699 /usr/sbin/iptables -t nat -C CNI-f7bdb61044a7824a7beae631 ! -d 224.0.0.0/4 -j [...] 1546.020722 5719 5699 /usr/sbin/iptables -t nat -A CNI-f7bdb61044a7824a7beae631 ! -d 224.0.0.0/4 -j [...] 1546.022902 5720 5699 /usr/sbin/iptables -t nat -C POSTROUTING -s 10.4.0.7 -j CNI-f7bdb61044a7824a7beae631 [...] 1546.024765 5721 5699 /usr/sbin/iptables -t nat -A POSTROUTING -s 10.4.0.7 -j CNI-f7bdb61044a7824a7beae631 [...] 1546.035429 5722 5698 /usr/local/libexec/cni/portmap 1546.045134 5727 5698 /usr/local/libexec/cni/firewall 1546.068492 5731 694 /usr/sbin/iptables-restore -w -n 1546.083718 5732 5727 /usr/sbin/iptables --version 1546.085693 5733 5727 /usr/sbin/iptables -t filter -S --wait 1546.089681 5735 5730 /usr/sbin/iptables -t filter -S --wait 1546.094914 5736 5730 /usr/sbin/iptables -t filter -C FORWARD -j CNI-ISOLATION-STAGE-1 -m comment [...] 1546.097479 5737 5730 /usr/sbin/iptables -t filter -C CNI-ISOLATION-STAGE-1 -i nerdctl0 ! -o [...] 1546.100883 5738 5730 /usr/sbin/iptables -t filter -C CNI-ISOLATION-STAGE-1 -j RETURN -m comment [...] 1546.103125 5739 5730 /usr/sbin/iptables -t filter -C CNI-ISOLATION-STAGE-2 -o nerdctl0 -j DROP [...] 1546.105416 5740 5730 /usr/sbin/iptables -t filter -C CNI-ISOLATION-STAGE-2 -j RETURN -m comment [...] 1546.109202 5741 5698 /usr/local/libexec/cni/tuning 1571.463778 5747 5620 nerdctl run -d busybox sleep 1000 1571.703204 5752 5308 /usr/local/bin/containerd-shim-runc-v2 -namespace default -address /run/containerd/containerd.sock -publish-binary /usr/local/bin/containerd -id 91d88628300f95d0f66be52d11f76fd4bf32bc5d712785ffbf0cfc484992c907 [...] 1571.710973 5758 5757 /usr/local/bin/containerd-shim-runc-v2 -namespace default -id 91d88628300f95d0f66be52d11f76fd4bf32bc5d712785ffbf0cfc484992c907 -address /run/containerd/containerd.sock 1571.726153 5766 5764 /usr/local/bin/nerdctl _NERDCTL_INTERNAL_LOGGING /var/lib/nerdctl/1935db59 1571.756595 5777 5765 runc --root /run/containerd/runc/default --log /run/containerd/io.containerd.runtime.v2.task/default/91d88628300f95d0f66be52d11f76fd4bf32bc5d712785ffbf0cfc484992c907/log.json --log-format json create --bundle [...] 1571.771180 5783 5780 runc init 1571.788612 5783 5780 runc init 1571.830662 5794 5784 /usr/local/bin/nerdctl internal oci-hook createRuntime 1571.917651 5799 5796 /usr/local/libexec/cni/bridge 1571.942755 5805 5788 /usr/lib/systemd/systemd-sysctl --prefix=/net/ipv4/conf/veth51118c02 --prefix=/net/ipv4/neigh/veth51118c02 --prefix=/net/ipv6/conf/veth51118c02 --prefix=/net/ipv6/neigh/veth51118c02 1571.943898 5806 5799 /usr/local/libexec/cni/host-local 1572.017723 5813 5799 /usr/sbin/iptables --version 1572.020105 5814 5799 /usr/sbin/iptables -t nat -S --wait 1572.023035 5815 5799 /usr/sbin/iptables -t nat -N CNI-e5888e0e18652cb25af6ec5b --wait 1572.025738 5816 5799 /usr/sbin/iptables -t nat -C CNI-e5888e0e18652cb25af6ec5b -d 10.4.0.8/24 -j ACCEPT [...] 1572.028387 5817 5799 /usr/sbin/iptables -t nat -A CNI-e5888e0e18652cb25af6ec5b -d 10.4.0.8/24 -j ACCEPT [...] 1572.032455 5818 5799 /usr/sbin/iptables -t nat -C CNI-e5888e0e18652cb25af6ec5b ! -d 224.0.0.0/4 -j [...] 1572.035165 5819 5799 /usr/sbin/iptables -t nat -A CNI-e5888e0e18652cb25af6ec5b ! -d 224.0.0.0/4 -j [...] 1572.038063 5820 5799 /usr/sbin/iptables -t nat -C POSTROUTING -s 10.4.0.8 -j CNI-e5888e0e18652cb25af6ec5b [...] 1572.040641 5821 5799 /usr/sbin/iptables -t nat -A POSTROUTING -s 10.4.0.8 -j CNI-e5888e0e18652cb25af6ec5b [...] 1572.045705 5822 5794 /usr/local/libexec/cni/portmap 1572.050726 5826 5794 /usr/local/libexec/cni/firewall 1572.065868 5830 694 /usr/sbin/iptables-restore -w -n 1572.072100 5831 5826 /usr/sbin/iptables --version 1572.074249 5832 5826 /usr/sbin/iptables -t filter -S --wait 1572.078250 5833 5826 /usr/sbin/iptables -t filter -S --wait 1572.081973 5834 5826 /usr/sbin/iptables -t filter -C FORWARD -j CNI-ISOLATION-STAGE-1 -m comment [...] 1572.084627 5835 5826 /usr/sbin/iptables -t filter -C CNI-ISOLATION-STAGE-1 -i nerdctl0 ! -o [...] 1572.087415 5837 5826 /usr/sbin/iptables -t filter -C CNI-ISOLATION-STAGE-1 -j RETURN -m comment [...] 1572.089858 5838 5826 /usr/sbin/iptables -t filter -C CNI-ISOLATION-STAGE-2 -o nerdctl0 -j DROP [...] 1572.092293 5839 5826 /usr/sbin/iptables -t filter -C CNI-ISOLATION-STAGE-2 -j RETURN -m comment [...] 1572.096460 5840 5796 /usr/local/libexec/cni/tuning 1572.202532 5845 5764 runc --root /run/containerd/runc/default --log /run/containerd/io.containerd.runtime.v2.task/default/91d88628300f95d0f66be52d11f76fd4bf32bc5d712785ffbf0cfc484992c907/log.json --log-format json start 91d88628300f95d0f66be52d11f76fd4bf32bc5d712785ffbf0cfc484992c907 [...] 1572.214671 5787 5786 sleep 1000
标签：iptables,...,sbin,启动,--,nerdctl,usr,local,对比 From： https://www.cnblogs.com/rincloud/p/16916616.html