SAE containers provide a temporary runtime environment for applications and typically require no O&M. You can use the lightweight webshell in the SAE console to identify and troubleshoot online issues by viewing and debugging containers. The base image of an SAE container is ephemeral and designed for the application runtime. Therefore, you do not need to start the SSH service in the image. You only need an executable /bin/bash. We also recommend that you include any necessary O&M tools to simplify troubleshooting.
Limitations
The webshell does not support Windows images.
Usage notes
You are responsible for code execution and the webshell runtime environment.
Application network environment
SAE applications are deployed in a user-created Virtual Private Cloud (VPC) and use namespaces to logically isolate service calls at the middleware layer. A namespace is bound to a vSwitch within the VPC. A namespace can be bound to only one vSwitch, but a vSwitch can support multiple namespaces. Because the IP addresses within a VPC are private, applications in different VPCs cannot access each other. Namespaces primarily provide logical isolation at the middleware layer. Applications in different namespaces are isolated from each other for services such as service discovery and configuration delivery.
For more information about the principles and product details of VPC, see How it works.
By design, SAE containers cannot directly access services outside their VPC, except for other Alibaba Cloud services like Object Storage Service (OSS) and Container Registry. Without additional configuration, your container runs in an isolated network, which makes the SAE application container inaccessible from the outside.
The following example shows that a container cannot access the internet.
[root@xxx:serverlesswar-12504560-a374-4471-80c7-d799d69ba3f7-xxx admin]# ping www.taobao.com
PING www.taobao.com.danuoyi.tbcache.com (xxx.xxx.xxx.xxx) xxx bytes of data.
^C
--- www.taobao.com.danuoyi.tbcache.com ping statistics ---
10 packets transmitted, 0 received, 100% packet loss, time 9198ms
If a container needs to access services on the internet, you must purchase a NAT gateway and configure an SNAT rule for the vSwitch in the VPC. For more information, see Configure a NAT gateway to allow an SAE application to access the internet.
By configuring SNAT entries, an SNAT rule allows instances without public IP addresses in a VPC to access the internet through an Elastic IP Address (EIP) bound to a NAT gateway. This allows them to call internet-facing services and retrieve internet resources. For more information, see Internet-facing products.
Building an image
Based on Alibaba Cloud Container Registry, SAE provides integrated image building and management features. The base image used for building is centos:7, which is pre-configured with a runtime environment that includes language and encoding settings, the time zone, and OpenJDK.
The purpose of a container is to run an application. To avoid consuming the runtime resources of all users, SAE does not integrate an extensive set of tools. Therefore, if you require additional tools in your container, you must build a custom image or retrieve the tools from OSS as needed. For more information, see Create a Java image.
Open a webshell
Follow these steps to perform basic O&M tasks by using the webshell:
On the SAE Application List page, select a region and namespace at the top, and click the ID of the target application to open the application details page.
-
On the Basic Information page, click the Instances tab.
-
On the Instances tab, in the Default Group section, find the target instance and click Webshell in the Actions column.
-
Optional: After the webshell opens, you can click the
icon in the upper-right corner of the window to switch to full-screen mode. -
Run commands in the webshell window as needed to view and debug your container.
For more information, see Get instance metadata and Diagnose an application.
Get instance metadata
After you successfully deploy an application in SAE, you can obtain basic metadata about the instance, including the security group ID, VPC ID, and vSwitch ID.
|
Metadata item |
Description |
|
/etc/podinfo/sgId |
The path to the file that stores the security group ID metadata. |
|
/etc/podinfo/vpcId |
The path to the file that stores the VPC ID metadata. |
|
/etc/podinfo/vswitchId |
The path to the file that stores the vSwitch ID metadata. Note
If there are multiple vSwitches, the vSwitch IDs are separated by commas (,). |
You can log on to the SAE console and run the following commands in the webshell window to verify the metadata for the security group ID, VPC ID, and vSwitch ID.
-
Run the following command to go to the
podinfodirectory:cd /etc/podinfo/NoteIf the
can't cd to /etc/podinfo/error message appears, you can Restart the instance or Deploy Application to resolve the issue. -
Run the following command to view all files that contain instance metadata:
lsExpected output:
sgId vpcId vswitchId -
Run the following commands as needed to verify the corresponding metadata within the instance.
-
Get the security group ID.
cat sgIdExpected output:
sg-2ze4ddm2rqgenvcx****sh-4.2# -
Get the VPC ID.
cat vpcIdExpected output:
vpc-2zeqku2oevokwm66b****sh-4.2# -
Get the vSwitch ID.
cat vswitchIdExpected output:
vsw-2zewmy4ynhljytzhu****sh-4.2#
-
Copy installation commands
You can log on to the SAE console and follow these steps to install commands in the webshell window as needed.
Commands installed in a webshell session are lost after the container is rebuilt. For frequently used commands, install them when you build the image.
-
Click the
icon in the upper-right corner of the webshell window. -
In the Copy Command dialog box that appears, select the components to install as needed, preview the command, and then click Copy.
-
Install openssh: OpenSSH is a free, open-source implementation of the Secure Shell (SSH) protocol. OpenSSH provides a server-side daemon and client-side tools to encrypt data during remote control and file transfer sessions. By installing OpenSSH, you can use remote debugging capabilities such as SSH remote logon and file uploads or downloads with SFTP and SCP to temporarily debug a specific SAE application instance.
-
Install net-tools (netstat): The netstat command monitors network status. It can display information such as routing tables, active network connections, and the status of each network interface device.
-
Install iroute (ss): The Socket Statistics (ss) command retrieves socket statistics. Although it returns information similar to the netstat command, the ss command can display more detailed TCP and connection state information more quickly.
-
-
Paste the copied command into the webshell window and press Enter to run it.
Diagnose an application
Routine checks
You can diagnose an SAE application by performing routine checks, such as verifying the process, threads, and Java Virtual Machine (JVM) health for a Java application.
-
Run the following command to check whether the application's Java process exists.
ps -ef | grep javaNoteA container typically uses its main process to start an application. If the application stops, the container also exits. SAE then automatically restarts the exited container to prevent service interruptions.
-
If the process does not exist, run the
dmesg | grep -i killcommand to check for out-of-memory (OOM) logs. -
If such logs exist, it indicates that the application's process was stopped. You need to check the
hs_err_pid{PID}.logfile in the working directory to identify the root cause.
-
-
For online analysis of Java applications, you can also use Arthas, an open-source tool from Alibaba. We recommend integrating the Arthas tool into your test image for routine diagnostics. Arthas can display Java class loading status in real time, making it easy to observe method input and output parameters, environment variables, and more.
-
Connect to the internet.
For more information, see Configure a NAT gateway to allow an SAE application to access the internet.
-
Run the following command to download Arthas.
sudo wget https://alibaba.github.io/arthas/arthas-boot.jar -
Run the following command to start Arthas.
sudo java -jar arthas-boot.jar
-
Upload and download logs
If routine checks are insufficient, upload the logs from the container to the cloud and then download them to your local machine for analysis.
-
For files up to 10 MB, use the webshell's built-in file transfer features. For more information, see Use a webshell to upload and download files.
-
For files larger than 10 MB: You can use Alibaba Cloud OSS. The OSS service is accessible from all Alibaba Cloud network environments, so you can use it to upload and download logs. Follow these steps:
-
Install the OSS command-line tool (ossutil) inside the container. For more information, see Install the OSS command-line tool.
This topic uses a 64-bit CentOS system as an example. If your container does not have internet access, you can download the file to your local machine, upload it to OSS, and then obtain the VPC-internal endpoint of OSS to download the file from within the container.
-
Run the following command to download ossutil.
sudo wget http://gosspublic.alicdn.com/ossutil/1.5.0/ossutil64 -
Run the following command to change the file permissions.
sudo chmod 755 ossutil64
-
-
Configure the OSS command-line tool with the endpoint for the VPC in the current region and the AccessKey of the account that will receive the uploaded files. Then, check an existing bucket to verify that the OSS service is available.
Note-
Ensure that OSS is activated for an Alibaba Cloud account, which does not need to be the current one.
-
Create a bucket. For more information, see Create a bucket in the console.
-
Run the following command to create a configuration file to store OSS access information.
Follow the prompts to configure your AccessKey and endpoint information. You do not need to enter an STS token.
./ossutil64 config -
Run the following command to list all buckets.
Check whether the account is available. If an error is reported, the configuration is incorrect.
./ossutil64 lsExample output:
CreationTime Region StorageClass BucketName 2021-12-08 18:53:46 +0800 CST oss-cn-hangzhou Standard oss://test-bucket -
Run the following command to create a sample log file named sae-app.log.
echo "Hello" > sae-app.log -
Run the following command to upload the log file to the specified bucket.
./ossutil64 cp sae-app.log {bucket-address}Example:
./ossutil64 cp sae-app.log oss://test-bucket
-
-
Verify the result.
-
Method 1: Run the following command to view the uploaded sample file.
./ossutil64 ls oss://test-bucketExample output:
LastModifiedTime Size(B) StorageClass ETAG ObjectName 2021-12-08 19:26:18 +0800 CST 6 Standard 09F7E02F1290BE211DA707A266F1**** oss://cri-55md3gmii09m****-chart/sae-app.log Object Number is: 1 0.047758(s) elapsed -
Method 2: Find your log file in the OSS console or other tools, download it to your local machine, and then use your preferred tools for analysis.
-