Tricks

ssh

Images should run as non-root, arbitrary users but that makes anything that uses ssh (like git) a pain in the ass. ssh expects a username for the running UID, which you might not have at runtime. Fake it out and pretend to be root with libuidwrapper and a homedir that you can create at runtime as the running user:

Dockerfile:
RUN apt update && apt -y install ... libuid-wrapper
RUN sed -i 's|:/root:|:/var/tmp/user:|' /etc/passwd

Not using 'usermod -d' there because it doesn't work for root.

ENTRYPOINT/CMD wrapper script:
export HOME=/var/tmp/user
mkdir -p "$HOME/.ssh"
chmod 700 "$HOME"
chmod 700 "$HOME"/.ssh
export LD_PRELOAD=libuid_wrapper.so UID_WRAPPER=1 UID_WRAPPER_ROOT=1
/app/do-ssh-stuff.py

Note that this doesn't change your uid, it just makes ssh look up usernames and homedirs for root instead of the running uid.

git

If you're pushing/pulling from ssh urls, use the ssh trick above and add this to the entrypoint/cmd wrapper script as well so ssh doesn't moan about host keys:

git config --global core.sshCommand 'ssh -o StrictHostKeyChecking=no'

If you're really worried about MITM attacks, add the host keys to /var/tmp/user/.ssh/known_hosts in your Dockerfile instead.

Debug

Processes

Find docker processes from system shell # docker ps # ps -eo pid,cgroup,cmd | grep <first 8 chars of containerID>

Network

Look at the network config from a container's namespace # nsenter -t $(docker inspect --format '{{.State.Pid}}' <containerid>) -n ip {addr|route|...} or run bash instead of ip to get a shell in the namespace.