OxL Reference
EnglishРусский

III.7 Remote debugger

After the Go/Delve model: the process is started in headless mode, the debugger connects over the network.

sh
$ ./shop --debug-listen 0.0.0.0:2345 --role api
$ oxl debug attach 10.0.3.7:2345              # from the developer's machine
$ oxl debug --node api-2 --cluster shop.internal:7000   # through the cluster, without opening a port
  • --debug-listen enables the DAP server in the process. Without the flag the debugger code is inactive and the port is not open.
  • The connection is over mTLS only. The client MUST present a principal certificate with the role debug (issued by oxl keys issue --role debug); in the dev profile the token --debug-token is enough.
  • The policy debug in this implementation (an edition 1.0 correction, D-8056; DIV-041; D-6401, D-6652): access is granted to a principal with the role Admin, debug or inspect, or to a cluster certificate with a role.
  • oxl debug --node <id> proxies the session through the inter-node protocol: a connection to any node of the cluster, without opening a separate port; it is enabled on a node by the command oxl debug enable --node <id> --for 30m (per the debug policy).
  • Modes: --non-stop (the default in prod: only the task with the breakpoint stops, the others keep running) and --all-stop.
  • For readable stacks in prod debug information is required (debug-info = "line" by default; full by a build flag).
  • Every connection and action of the debugger is written to oxl.audit.

Source: docs/spec/oxl-standard.en.md