Choose a shell or inspection method for a Docker container

For a running container that contains a shell, use docker exec -it. For a Compose-managed service, docker compose exec selects the service without requiring its full container name. A stopped or shell-free container needs a different inspection method.

Start a separate shell

docker exec -it myapp /bin/sh
# Use Bash only if the image contains it:
docker exec -it myapp /bin/bash

Choose one command. exit normally ends this added shell while leaving the main process running. The shell still shares container files and processes, so commands you run can affect the service.

Use -u USER or -w DIRECTORY when you need a particular account or working directory. UID 0 is available through -u 0 where allowed, but it does not override all mount or security restrictions. The image's operating-system family alone does not guarantee that a particular shell exists.

Use Compose's service selection

docker compose ps
docker compose exec web /bin/sh

Here web is the service name in the selected Compose project. Compose normally allocates an interactive TTY for exec; in scripts, use -T when no terminal should be allocated. For multiple replicas, select the intended instance with the supported --index option. Confirm the project/context so an identical service name does not send you to the wrong environment.

Inspect a stopped container

Exec cannot launch a process in a stopped container. To retrieve evidence without restarting its application:

docker cp myapp-stopped:/app/logs ./logs
docker diff myapp-stopped

If a new inspection container is useful, capture applicable changes and override its entrypoint explicitly:

docker commit myapp-stopped myapp:inspection
docker run --rm -it --entrypoint /bin/sh myapp:inspection

The image must contain /bin/sh. A commit excludes mounted volume contents and is not a complete backup of runtime configuration. The new container does not automatically inherit all the old mounts or network settings. Remove temporary resources after the investigation under your retention policy.

When the image has no shell

Distroless or scratch-based images can omit every shell. Use copy, logs, diff, a purpose-built debug variant, or a supported debug workflow. Installing tools into a minimal image may not be possible because it lacks a package manager too.

Kubernetes ephemeral debug containers can provide tools without changing the application image, but they have their own root filesystem. Access to the target process or filesystem depends on runtime support, namespace sharing, and permissions.

FAQ

Why is the hostname a short identifier?

Docker commonly defaults it from the container ID, but the configured hostname can be overridden. Renaming a container is not the same operation as changing its hostname.

Why are some environment variables missing?

Exec uses the environment recorded when the container was created, plus explicit overrides such as docker exec -e KEY=value. It does not inherit arbitrary later exports made by an entrypoint or interactive shell. A login shell can also load different profile files.

Should I use attach instead?

Attach connects to the existing main-process streams. Use it only when that is the intended interaction. It does not create a fresh diagnostic shell.

See Docker exec, Compose exec, and commit.