Copy files out of a Docker container

Use docker cp CONTAINER:/path LOCAL_PATH to retrieve a file or directory. The container may be running or stopped, provided it still exists. This is useful for collecting logs, configuration, and build outputs after a failure.

docker cp myapp:/var/log/app/error.log ./error.log
docker cp myapp:/var/log/app ./app-logs

The local destination belongs to the machine running the Docker CLI. If app-logs already exists as a directory, the second command places the app directory inside it. To copy only the source directory's contents:

mkdir -p app-logs
docker cp myapp:/var/log/app/. ./app-logs/

Know what the copy preserves

Docker copies directory trees recursively and preserves permissions where possible. Files copied locally are normally owned by the invoking user and group; -a requests source ownership instead. You may need additional local privileges to preserve numeric ownership.

Do not assume symlinks are always dereferenced. Use -L when you explicitly want to follow source links, and check the destination before overwriting anything. Docker does not create missing parent directories along an arbitrary destination path.

A live copy is not an application-consistent snapshot. If a process is appending, rotating, or rewriting files during the transfer, the result can be incomplete or inconsistent. Flush and rotate logs, or use the application's backup procedure for structured data.

Choose another method when appropriate

For continuous sharing, use an intentionally configured bind mount or volume. A bind mount exposes a directory on the daemon host; with a remote daemon, that is not the CLI machine.

To retrieve image contents without starting the application:

docker create --name inspect-image myapp:1.2
docker cp inspect-image:/app/config.yml ./config.yml
docker rm inspect-image

The image needs a valid creation configuration. Docker documents limitations for special files under /proc, /sys, /dev, tmpfs, and certain mounts. A deliberate docker exec plus tar stream can handle some live resources, but requires a running container and suitable tools.

FAQ

Can this work with a remote Docker daemon?

Yes. A configured context can select the remote daemon while the destination remains local to the CLI:

docker --context remote-host cp myapp:/var/log/app/error.log ./error.log

remote-host must be an existing trusted context. This is not a general container-to-container or arbitrary host-to-host copy command.

What about large directories?

Select only the evidence you need. A compressed tar stream may reduce network traffic when the container has the tools, but compression consumes CPU and does not make an actively changing dataset consistent.

How does Kubernetes differ?

kubectl cp POD:/path ./path -c CONTAINER serves a similar purpose and usually requires tar in the container. Check permissions and the application's consistency requirements there too.

See docker cp and Docker contexts.