Application debugging in a restricted container environment

A system for debugging an application running in a container, comprising:

• a non-transitory memory;
• and
• one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
• detecting a system call from a first process identified by a first process identifier;
• determining whether the first process identifier is related to an application, wherein the application runs in a container that restricts one or more system calls or one or more capabilities, and wherein the first process identifier is related to the application if the first process identifier is assigned to an initial process that is an executing instance of the application or a child of the initial process;
• if the first process identifier is related to the application, performing a capability check that provides a set of capabilities used by the system call, and
• providing debug information based on the application run in the container, wherein the debug information includes one or more system calls from the application and each system call's corresponding set of capabilities.

A non-transitory machine-readable medium comprising a plurality of machine-readable instructions that when executed by one or more processors is adapted to cause the one or more processors to perform a method comprising:

• detecting, by a kernel, a set of system calls from an application running in a container, wherein the container restricts one or more system calls or one or more capabilities;
• for each system call of the set of system calls:
• determining whether a process that made the respective system call is related to the application, wherein the process is related to the application if the respective system call is from an initial process of the application or a child of the initial process;
• in response to a determination that the process is related to the application, determining a set of capabilities in accordance with invocation of the respective system call;
• and
• associating the respective system call with the set of capabilities;
• and
• providing debug information based on the application run in the container, the debug information including the association between one or more system calls and the set of capabilities used by the respective system call.