Tricks

ssh

Images should run as non-root, arbitrary users but that makes anything that uses ssh (like git) a pain in the ass. ssh expects a username for the running UID, which you might not have at runtime. Fake it out and pretend to be root with libuidwrapper and a homedir that you can create at runtime as the running user:

Dockerfile:
RUN apt update && apt -y install ... libuid-wrapper
RUN sed -i 's|:/root:|:/var/tmp/user:|' /etc/passwd

Not using 'usermod -d' there because it doesn't work for root.

ENTRYPOINT/CMD wrapper script:
export HOME=/var/tmp/user
mkdir -p "$HOME/.ssh"
chmod 700 "$HOME"
chmod 700 "$HOME"/.ssh
export LD_PRELOAD=libuid_wrapper.so UID_WRAPPER=1 UID_WRAPPER_ROOT=1
/app/do-ssh-stuff.py

Note that this doesn't change your uid, it just makes ssh look up usernames and homedirs for root instead of the running uid.

Debug

Processes

Find docker processes from system shell # docker ps # ps -eo pid,cgroup,cmd | grep <first 8 chars of containerID>

Network

Look at the network config from a container's namespace # nsenter -t $(docker inspect --format '{{.State.Pid}}' <containerid>) -n ip {addr|route|...} or run bash instead of ip to get a shell in the namespace.