Why Java Attach Fails on PID 1 in Containers and How to Fix It

Problem Reproduction

Running a Java process as PID 1 inside a container prevents arthas from attaching, producing

AttachNotSupportedException: Unable to get pid of LinuxThreads manager thread

. The issue is reproduced with a minimal Docker image built from openjdk:8u212-jdk-alpine and a simple Main class that prints "hello!" in a loop.

public class Main {
  public static void main(String args[]) throws Exception {
    while (true) {
      System.out.println("hello!");
      Thread.sleep(30 * 1000);
    }
  }
}

FROM openjdk:8u212-jdk-alpine
COPY ./ /app
WORKDIR /app/src/main/java/
RUN javac Main.java
CMD ["java", "Main"]

After building and running the container, both arthas and jstack fail with the same error, confirming the problem.

JVM Attach Workflow

Check for /tmp/.java_pid${pid} Unix socket; if present, verify permissions and connect.

If absent, create /proc/${pid}/cwd/.attach_pid${pid} to notify the JVM.

Determine whether the target is a LinuxThread.

If it is a LinuxThread, locate the LinuxThreadsManager and send SIGQUIT to all its child processes.

If not, send SIGQUIT directly to the target process.

The target process creates an Attach Listener, listens on /tmp/.java_pid${pid}, and proceeds with the requested operation (e.g., jstack dump or loading a JavaAgent such as Arthas).

Why PID 1 Fails

The JVM checks the thread model via confstr(_CS_GNU_LIBPTHREAD_VERSION,). On Alpine, which uses musl, this call returns 0, indicating the old LinuxThreads model. The JVM then treats the process as a LinuxThread, attempts to find its manager thread, and fails to locate a parent for PID 1, leading to the exception.

The LinuxThreads model implements threads using fork + shared memory, requiring a manager thread to handle signals. Modern NPTL replaces this with true kernel threads. Because Alpine reports the old model, the JVM follows the LinuxThreads path.

Workarounds

Create the .attach_pid${pid} file manually and send SIGQUIT :

pid=1 \
  && touch /proc/${pid}/cwd/.attach_pid${pid} \
  && kill -SIGQUIT ${pid} \
  && sleep 2 \
  && ls /proc/${pid}/root/tmp/.java_pid${pid}
# Now <code>java -jar arthas-boot.jar</code> attaches successfully.

Enable the Attach Listener at JVM startup: add -XX:+StartAttachListener via JAVA_TOOL_OPTIONS (e.g., JAVA_TOOL_OPTIONS=-XX:+StartAttachListener) so no manual steps are needed.

Use jattach : install with apk add jattach and run jattach ${pid} properties to achieve the same effect.

Upgrade the base image: OpenJDK 11 already drops the LinuxThreads check, and patched Alpine OpenJDK 8 images (e.g., eclipse-temurin:8-jdk-alpine) also fix the issue.

Conclusion

Running Java as PID 1 in containers triggers the old LinuxThreads path, causing attach tools like Arthas to fail. Creating the .attach_pid file, enabling StartAttachListener, or using newer JDK images resolves the problem without needing to change the container’s PID hierarchy.