Getting core dump in ECS using Bottlerocket OS

[josh-kim-resolver]

I'm trying to configure Bottlerocket OS to generate core dumps when containers crash in ECS. My goal is to create a bind mount between the host and the container so that the core dumps are preserved after a crash. To do this, I need the core dumps to be saved in a specific directory where the bind mount is created. However, I'm facing an issue configuring /proc/sys/kernel/core_pattern on the host, which is used to specify the core dump location, because it's read-only and I can't find a way to work around this limitation.

I read about bootstrap containers in the documentation and am wondering if they could be used to modify the core_pattern file. Any help or guidance on how to get core dumps in ECS using Bottlerocket OS would be greatly appreciated. Thanks!

[cloudwitch]

Also need core dumps for EKS and ECS.

I'm using a similar pattern to @josh-kim-resolver where the OS packages the dump into a tarball and my core dump handler container ships that to S3 via watching inotify.

[KCSesh]

Hey @josh-kim-resolver and @cloudwitch,

You should be able to update this value as apart of the Bottlerocket Settings, specifically here:
https://bottlerocket.dev/en/os/1.30.x/api/settings/kernel/#sysctl

You can either run the command directly:

apiclient set --json '
{
  "kernel": {
    "sysctl": {
      "kernel.core_pattern": "/tmp/core.%e.%p.%h.%t"
    }
  }
}
'

Which would then require a reboot.

Or you could set this value in the user-data of your instance, ensuring the value is set from the beginning.

[settings.kernel.sysctl]
"kernel.core_pattern" = "/tmp/core.%e.%p.%h.%t"