Inspect docker container FS changes from host

Question

I've started a docker container and I've modified a file. At some point later I'd like to inspect this change from the docker host. Now I use docker cp to export the file, inspect it, delete it. But this multistep copy-read-delete process seems like over kill if I just want to read a file.

Is there a better way to inspect filesystem changes in a docker container?

I need more info than docker diff is showing.

Answer 1

You can find the filesystem of a running container the Docker data directory, usually /var/lib/docker/. The specific location varies depending on which storage driver is used. In the case of AUFS, the location is `/var/lib/docker/aufs/mnt/${CONTAINER_ID}/.

$ HELLO_WORLD=$(docker run -d  ubuntu:12.04 /bin/sh -c "while true; do echo Hello world; sleep 1; done")
$ docker ps
CONTAINER ID        IMAGE               COMMAND                CREATED             STATUS              PORTS               NAMES
2524e196adf0        ubuntu:12.04        /bin/sh -c while tru   4 seconds ago       Up 3     seconds                            naughty_brown
$ echo $HELLO_WORLD
2524e196adf0b985e84a22503d5fd1f2110c6a0cf175f12496f11f0043e799fa
$ sudo ls /var/lib/docker/aufs/mnt/${HELLO_WORLD}/
bin  boot  dev  etc  home  lib  lib64  media  mnt  opt  proc  root  run  sbin  selinux  srv  sys  tmp  usr  var

Answer 2

This is not a general solution, but in special cases, you can use mounted volumes:

Start the container with volume:

sudo docker run -v /host_path/shared:/shared <container>

Store files you want to inspect in container dir /shared or copy & ln files to /shared and make needed files symbolic links to files stored in /shared.

cp /mydir/myfile /shared/myfile
ln -s -f /shared/myfile /mydir/myfile

Then you can inspect these files directly in /host_path/shared.

Note: You cannot symbolic-link special files like /etc/passwd, /etc/hostname etc.