How to debug a pod

October 26, 2025

kubectl debug

kubectl debug <pod-id> -ti --image=nicolaka/netshoot --target=<pod-name> --profile=sysadmin

Check list

Check open connections (signs of saturation)

ss -s                          # quick summary (states: ESTAB, TIME-WAIT, SYN-RECV)
ss -tuna | grep 8080 | wc -l   # total connections to the app port
ss -tuna | grep SYN_RECV       # half-open connections (possible overload)
ss -tuna | grep TIME_WAIT | wc -l  # connections closing slowly

Check for socket leaks or system limits

cat /proc/sys/net/ipv4/ip_local_port_range
cat /proc/sys/net/ipv4/tcp_fin_timeout
cat /proc/sys/net/ipv4/tcp_tw_reuse
ulimit -n                      # file descriptor limit

Test local endpoint (no network involved)

# If this is slow, the issue is inside the container, not the network.
time curl -v http://127.0.0.1:8080/health
time curl -v http://127.0.0.1:8080/predict

Test access from another service (within the cluster)

# If this is slow but the local one isn’t, it’s a network or connection bottleneck.
time curl -v http://<service>:<port>/status

Monitor process usage (signs of CPU/memory saturation)

ps auxf | grep python
top -p <PID>
cat /proc/<PID>/status | egrep 'Threads|VmRSS'

If you suspect too many client connections

lsof -p <PID> | grep TCP | wc -l
netstat -anp | grep 8080 | grep ESTAB | wc -l

Check if real traffic is reaching and its volume

# Measures if requests are actually arriving when latency increases.
tcpdump -i any -nn port 8080 -c 100

(optional) Inspect specific connections

ss -tp state established | grep <service-name>

Bonus: use watch

watch -n1 ss -s