Explore a Docker container filesystem

Use docker exec to inspect a running container with tools it already contains. Use docker cp, docker export, or docker diff when you need an offline view or the container has stopped. Each method shows a different part of the state.

Inspect a running container

docker exec -it myapp /bin/sh

Then run ordinary read commands, such as ls -l /app/logs. The shell shares the live container filesystem, so edits affect the running application. Minimal images may have no shell; a stopped container cannot run exec commands.

Copy or export for offline inspection

docker cp myapp:/app/logs ./logs
docker export -o snapshot.tar myapp
tar -tf snapshot.tar

Export flattens the container filesystem into an archive. It excludes mounted volume contents; when a volume obscures a directory, the underlying container directory can be exported instead. It does not preserve the original image's layers, tags, and full configuration.

A running export is not guaranteed to be an atomic or application-consistent snapshot. Stop or quiesce writes where required and use a database's supported backup procedure for its data. Review an archive before extracting it into an isolated analysis directory, especially if the container contents are untrusted.

Capture applicable changes as an image

docker commit myapp myapp:inspection
docker run --rm -it --entrypoint /bin/sh myapp:inspection

The explicit entrypoint avoids accidentally running the original application instead of the shell. The snapshot must contain that shell. Commit normally pauses the source container while capturing changes, so it can briefly affect service; it excludes mounted volume data and is not a complete running-state checkpoint.

Inspect in the new container, then remove the temporary image when it is no longer needed. This does not replace a reproducible Dockerfile.

Investigate a stopped container or an image

docker cp stopped-container:/app/logs ./stopped-logs
docker diff stopped-container

Diff reports added (A), changed (C), and deleted (D) paths relative to the container's starting filesystem. It is not a complete audit trail of file contents or changes inside every mounted volume.

To explore an image without starting its application:

docker create --name inspect-image myapp:1.2
docker export -o image-files.tar inspect-image
docker rm inspect-image
docker history myapp:1.2

Creation still needs a valid command configuration. History describes image build history; export provides a flattened view, not a layer-by-layer reconstruction.

FAQ

Can I inspect a distroless image?

Yes, use copy/export/diff without assuming a shell. Kubernetes debug containers provide another option, but their filesystem is separate; accessing another container's root depends on runtime and process-namespace support.

How do I inspect disk use?

If available, du inside the container measures reachable filesystem paths and may include mounts. docker system df -v reports Docker-managed usage, including writable layers and volumes separately. These totals answer different questions and may omit other host-side logs or storage.

See export, commit, and diff.