In this lesson, you will learn how to use ftrace to gain deep visibility into the kernel execution path triggered by container-related system calls.
The Mechanism of Kernel Function Tracing
When a container process performs an operation—such as creating a new network namespace or attaching a veth pair—it invokes specific system calls that traverse deep into the kernel. ftrace acts as a surgical instrument, allowing you to hook into these function calls as they execute. Unlike logging, which provides intermittent status reports, ftrace provides a high-fidelity timeline of every function branch taken by the CPU.
Tracing System Calls to Kernel Implementation
To observe how container primitives manifest in the kernel, we utilize the function_graph tracer. This allows us to visualize the hierarchical call stack of a specific system call. For instance, if you want to trace the kernel functions involved in a process entering a network namespace via setns(), you can target the syscall handler.
# Setup the tracer to monitor the kernel path
cd /sys/kernel/debug/tracing/
echo function_graph > current_tracer
echo sys_setns > set_ftrace_filter
# Enable tracing and execute your container command
echo 1 > tracing_on
nsenter -t <pid> -n /bin/bash
echo 0 > tracing_on
# Read the result
cat trace
The output will show a tree-like structure starting from sys_setns. You will see calls branching into __set_ns_common, then potentially into namespace-specific operations like net_ns_install if you are dealing with network namespaces. By tracing this, you can verify exactly which kernel subsystems (like net/core or net/ipv4) are touched when a process migrates or joins a container network environment.
Why This Matters
By monitoring these paths, you can debug issues that exist beneath the abstraction layers of Docker or Kubernetes. If a veth interface fails to attach correctly or if Netfilter hooks are being bypassed during a namespace transition, ftrace reveals the exact function where the execution path diverges from the expected flow. This is the definitive way to validate that your container networking configuration is interacting with the kernel exactly as intended.
Key Takeaway: ftrace with function_graph provides an executable map of the kernel's internal logic, transforming "black-box" system calls into a transparent sequence of operational events.