Strange container names when using Docker Desktop

[thediveo]

Why does Edgeshark on some systems show "strange" container names, such as in this screenshot? Docker works correctly and reports the container as usual as angry_ahab. Is this a bug?

[thediveo]

No, this isn't a bug, but an Edgeshark feature nicknamed "the turtlefinder" 😀

The bracketed [services.linuxkit/02-docker] indicates that this container is "inside" another container, because the Docker daemon runs inside another (non-Docker) container as opposed to running directly in a host (where the PID 1 is). This is due to the way Docker Desktop is designed.

This can be seen here:

Here, we've highlighted a containerd container named services.linuxkit/02-docker that runs on the host and is attached to the host network. Now, the containerd engine uses what is termed "namespaces" to separate sets of containers (please don't confuse these namespaces with the Linux kernel namespaces and not with Kubernetes namespaces either). services.linuxkit is the namespace used by Docker Desktop for its own containerd containers that form the Desktop infrastructure. And 02-docker is the name of the container inside this namespace.

services.linuxkit/02-docker then contains a the Docker dockerd daemon as well as the containerd daemon. Please note that this containerd is different from the one directly running inside the host. Now, if we look at the top of the screenshot we thus find three container engines being detected and listed: one Docker engine, and two containerd engines. Turtles all the way down!

Now that the Docker engine managing our user workload is contained in another container, and thus also its managed containers, we thus prepend [services.linuxkit/02-docker] to the Docker container names, such as in [services.linuxkit/02-docker]:angry_ahab.

But why don't we show the angry_ahab container inside the services.linuxkit/02-docker container? That is because Edgeshark deals with the networking view: even if we logically put one container into another, their networking namespaces are still flat and thus side-by-side. A very early prototype of Edgeshark actually rendered hierarchical containers, but this turned out to be highly confusing and not in line with how the Linux namespace technology works. In the end, the quickly dropped this experiment and stuck to the flat display you'll see today.