jmap can't analyse buildfarm java binary

[DarkMatterV]

build command In Dockerfile is

RUN bazel build //src/main/java/build/buildfarm:buildfarm-server --jvmopt="-Xmx256g"
RUN mv /app-buildfarm/bazel-buildfarm/bazel-bin/src/main/java/build/buildfarm/buildfarm-server* /app-buildfarm/server
...
RUN bazel build //src/main/java/build/buildfarm:buildfarm-shard-worker --jvmopt="-Xmx256g" \
    && chmod +x delay.sh \
    && chmod +x generate_coverage.sh \
    && chmod +x macos-wrapper.sh \
    && bazel build //:execution_wrappers
RUN mv /app-buildfarm/bazel-buildfarm/bazel-bin/src/main/java/build/buildfarm/buildfarm-shard-worker* /app-buildfarm/worker
...
ENTRYPOINT ["/entrypoint.sh"]

and entrypoint.sh is

# app_dir: /app-buildfarm/server or /app-buildfarm/worker
cd $app_dir

# app_exe: ./buildfarm-server or ./buildfarm-shard-worker
$app_exe /app-buildfarm/config/config.yml

docker build generate image and run container, the container is running successfully and available.

but when I found memory problem， I want use jmap -heap {pid} to locate the problem， but jmap is error：

Attaching to process ID 108, please wait...
ERROR: ptrace(PTRACE_ATTACH, ..) failed for 108: Operation not permitted
Error attaching to process: sun.jvm.hotspot.debugger.DebuggerException: Can't attach to the process: ptrace(PTRACE_ATTACH, ..) failed for 108: Operation not permitted
sun.jvm.hotspot.debugger.DebuggerException: sun.jvm.hotspot.debugger.DebuggerException: Can't attach to the process: ptrace(PTRACE_ATTACH, ..) failed for 108: Operation not permitted
        at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal$LinuxDebuggerLocalWorkerThread.execute(LinuxDebuggerLocal.java:163)
        at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal.attach(LinuxDebuggerLocal.java:278)
        at sun.jvm.hotspot.HotSpotAgent.attachDebugger(HotSpotAgent.java:671)
        at sun.jvm.hotspot.HotSpotAgent.setupDebuggerLinux(HotSpotAgent.java:611)
        at sun.jvm.hotspot.HotSpotAgent.setupDebugger(HotSpotAgent.java:337)
        at sun.jvm.hotspot.HotSpotAgent.go(HotSpotAgent.java:304)
        at sun.jvm.hotspot.HotSpotAgent.attach(HotSpotAgent.java:140)
        at sun.jvm.hotspot.tools.Tool.start(Tool.java:185)
        at sun.jvm.hotspot.tools.Tool.execute(Tool.java:118)
        at sun.jvm.hotspot.tools.HeapSummary.main(HeapSummary.java:49)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at sun.tools.jmap.JMap.runTool(JMap.java:201)
        at sun.tools.jmap.JMap.main(JMap.java:130)
Caused by: sun.jvm.hotspot.debugger.DebuggerException: Can't attach to the process: ptrace(PTRACE_ATTACH, ..) failed for 108: Operation not permitted
        at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal.attach0(Native Method)
        at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal.access$100(LinuxDebuggerLocal.java:62)
        at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal$1AttachTask.doit(LinuxDebuggerLocal.java:269)
        at sun.jvm.hotspot.debugger.linux.LinuxDebuggerLocal$LinuxDebuggerLocalWorkerThread.run(LinuxDebuggerLocal.java:138)

I wonder if this has something to do with bazel's sandbox？Can you help me？

[DarkMatterV]

In addition, is non-bazel compilation and building provided?

[werkt]

We've not provided non-bazel building before this. What's the use case?

Regarding this: Can't attach to the process: ptrace(PTRACE_ATTACH, ..) failed for 108: Operation not permitted says to me that there's an OS-, not Java-, level restriction in effect here. Perhaps running with --cap-add=SYS_PTRACE for the container may assist: https://stackoverflow.com/questions/19215177/how-to-solve-ptrace-operation-not-permitted-when-trying-to-attach-gdb-to-a-pro
Also, that capability may already be there with --privileged (if I understand the directions correctly), which is required for some of the cgroup manipulation we recommend anyway.

[DarkMatterV]

Thank you for your answer, you are right, running with --cap-add=SYS_PTRACE or --privileged for container are ok.