Inspecting Docker Images and Containers

Understanding Docker Filesystems

Docker containers offer a powerful way to package and run applications. However, it’s often necessary to inspect the filesystem inside a container or image – whether to understand its contents, recover files, or simply explore its structure. This tutorial outlines several methods for accomplishing this, covering scenarios from running containers to stopped containers and even pre-creation image inspection.

Why Inspect?

There are several reasons you might want to inspect a Docker image or container:

Troubleshooting: Diagnosing issues within a running application often requires examining files, configurations, and dependencies.
Security Auditing: Analyzing the contents of an image can help identify potential vulnerabilities or malicious code.
Understanding Images: Before deploying an image, you might want to understand its layers and structure.
Data Recovery: Extracting files from a container before it’s removed.

Inspecting a Running Container

The simplest and most common approach is to gain shell access to a running container. This allows you to use standard Linux commands to explore the filesystem.

Using docker exec

The docker exec command lets you execute a command inside a running container. To get an interactive shell (like bash), use the following:

docker exec -it <container_name_or_id> /bin/bash

-it: Allocates a pseudo-TTY connected to the container’s stdin, creating an interactive session.
<container_name_or_id>: The name or ID of the running container. You can find this using docker ps.
/bin/bash: The command to execute – in this case, launching a bash shell. If bash isn’t available (e.g., in minimal images), try /bin/sh.

Once you’ve executed this command, you’ll be dropped into a shell inside the container, allowing you to navigate the filesystem, view files, and run commands.

Example:

docker exec -it my_web_app /bin/bash
# You are now inside the container
ls -l /var/www/html

Inspecting a Stopped Container

If the container isn’t running, you can’t use docker exec. However, you can still access its filesystem.

Using docker cp

The docker cp command allows you to copy files/folders between a container and the host machine. This is particularly useful for retrieving files from a stopped container.

docker cp <container_name_or_id>:<source_path> <destination_path>

<container_name_or_id>: The name or ID of the stopped container.
<source_path>: The path to the file or directory inside the container.
<destination_path>: The path on the host machine where you want to copy the file or directory.

Example:

docker cp my_stopped_container:/var/log/app.log /tmp/

This command will copy the app.log file from the container to the /tmp/ directory on your host machine. To copy the entire container’s filesystem, you can copy the root directory (/) to a destination folder.

Inspecting an Image Before Creation

Sometimes you want to understand the contents of an image before you run it. This is possible by extracting the image’s layers.

Using docker save and tar

Save the image:
```
docker save <image_name> > image.tar
```
Extract the archive:
```
tar -xvf image.tar
```

This will extract the image’s layers into separate directories. You can then explore these directories to understand the image’s structure and contents. Be aware that this can create a large number of files and directories, depending on the complexity of the image.

Advanced Techniques

docker export: This command creates an archive of the container’s filesystem as a single tarball. It’s similar to docker save but doesn’t preserve image layers or history. Useful for creating a snapshot of a container’s state.
```
docker export <container_name_or_id> > container.tar
```
docker inspect: While not directly providing filesystem access, docker inspect gives you detailed metadata about the image or container, including environment variables, mount points, and entry points, which can help you understand its configuration.

Best Practices

Minimal Images: Use minimal base images (like Alpine Linux) to reduce the size of your images and improve security.
Layer Optimization: Optimize your Dockerfile to create efficient layers, minimizing image size and build times.
Security Audits: Regularly audit your images for vulnerabilities and outdated packages.