{"id":483358,"date":"2022-08-11T11:04:09","date_gmt":"2022-08-11T08:04:09","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/how-to-inspect-changes-to-a-docker-containers-filesystem\/"},"modified":"2022-08-11T11:04:09","modified_gmt":"2022-08-11T08:04:09","slug":"how-to-inspect-changes-to-a-docker-containers-filesystem","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/how-to-inspect-changes-to-a-docker-containers-filesystem\/","title":{"rendered":"#How to Inspect Changes to a Docker Container\u2019s Filesystem"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_84 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6a276a99b8600\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6a276a99b8600\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-1'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-inspect-changes-to-a-docker-containers-filesystem\/#%E2%80%9CHow_to_Inspect_Changes_to_a_Docker_Containers_Filesystem%E2%80%9D\" >&#8220;How to Inspect Changes to a Docker Container\u2019s Filesystem&#8221;<\/a><ul class='ez-toc-list-level-2' ><li class='ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-inspect-changes-to-a-docker-containers-filesystem\/#Using_Docker_Diff\" >Using Docker Diff<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-inspect-changes-to-a-docker-containers-filesystem\/#Interpreting_Docker_Diff_Output\" >Interpreting Docker Diff Output<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-inspect-changes-to-a-docker-containers-filesystem\/#Viewing_Content_in_the_Original_Image\" >Viewing Content in the Original Image<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-inspect-changes-to-a-docker-containers-filesystem\/#Comparing_Differences_Between_Two_Containers\" >Comparing Differences Between Two Containers<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/buradabiliyorum.com\/en\/how-to-inspect-changes-to-a-docker-containers-filesystem\/#Summary\" >Summary<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h1><span class=\"ez-toc-section\" id=\"%E2%80%9CHow_to_Inspect_Changes_to_a_Docker_Containers_Filesystem%E2%80%9D\"><\/span>&#8220;How to Inspect Changes to a Docker Container\u2019s Filesystem&#8221;<span class=\"ez-toc-section-end\"><\/span><\/h1>\n<div>\n<img loading=\"lazy\" decoding=\"async\" class=\"type:primaryImage alignnone size-full wp-image-803108\" data-pagespeed-no-defer=\"\" src=\"https:\/\/www.howtogeek.com\/wp-content\/uploads\/2022\/05\/Docker.jpeg?width=1198&amp;trim=1,1&amp;bg-color=000&amp;pad=1,1\" alt=\"Docker logo\" width=\"1602\" height=\"902\"\/><\/p>\n<p>Docker containers inherit their image\u2019s filesystem upon initial creation. The container\u2019s filesystem can diverge from the image\u2019s content after creation if changes are made to the container\u2019s <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/docs.docker.com\/storage\">writable layer<\/a>.<\/p>\n<p>The ability to inspect changes in the filesystem can help you debug issues and investigate missing data. Files written to the container\u2019s filesystem will be lost when that container\u2019s restarted or destroyed. In some cases you might be unintentionally performing writes that should be directed to a persistent volume instead.<\/p>\n<p>In this article, we\u2019ll share some techniques for identifying modifications made to container filesystems. You can use this information to track container activity and investigate discrepancies between different environments.<\/p>\n<h2 id=\"using-docker-diff\"><span class=\"ez-toc-section\" id=\"Using_Docker_Diff\"><\/span>Using Docker Diff<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The Docker CLI has a built-in command for this purpose. Running <code>docker diff<\/code> will enumerate all the changes made to files and directories within a particular container. It accepts the ID or name of the container you want to inspect.<\/p>\n<p>Start a simple container for demonstration purposes:<\/p>\n<pre>$ docker run -it --name alpine alpine:latest sh<\/pre>\n<p>This will start a new container running the Alpine image. Your terminal window will be attached to the container. Keep this window open.<\/p>\n<p>Now run <code>docker diff<\/code> in a second terminal session:<\/p>\n<pre>$ docker diff alpine<\/pre>\n<p>No output is produced as the fresh container still exactly matches the Alpine image\u2019s filesystem.<\/p>\n<p>Switch back to your first terminal that\u2019s still attached to the container. Run some commands that add, delete, or change files:<\/p>\n<pre>\/ # touch demo&#13;\n\/ # touch example<\/pre>\n<p>Return to your first shell window. Repeat the <code>docker diff<\/code> command to see the changes that have been made:<\/p>\n<pre>$ docker diff alpine&#13;\nA \/example&#13;\nC \/root&#13;\nC \/root\/.ash_history&#13;\nA \/demo<\/pre>\n<p>Now the two new files are visible in the command\u2019s output. Running <code>touch<\/code> also added entries to the container\u2019s shell history. The modification to <code>\/root\/.ash_history<\/code> is reported too, as well as the consequent change to the <code>\/root<\/code> directory.<\/p>\n<h2 id=\"interpreting-docker-diff-output\"><span class=\"ez-toc-section\" id=\"Interpreting_Docker_Diff_Output\"><\/span>Interpreting Docker Diff Output<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Each line of output produced by <code>docker diff<\/code> is prefixed by either <code>A<\/code>, <code>C<\/code> or <code>D<\/code> depending on the type of change that occurred:<\/p>\n<ul>\n<li><code>A<\/code> \u2013 The file or directory has been added to the container\u2019s filesystem. It doesn\u2019t exist in the original image.<\/li>\n<li><code>C<\/code> \u2013 The content of the file or directory is different to the version in the image.<\/li>\n<li><code>D<\/code> \u2013 A path that\u2019s present in the image has been deleted from the container.<\/li>\n<\/ul>\n<p>This information enables you to quickly look for discrepancies that could explain missing data or unexpected behavior.<\/p>\n<p>Any filesystem changes that don\u2019t show up in the output will have affected paths that are m<a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>ed to a Docker volume. These files are stored outside the container, independently of its filesystem, so they\u2019re not surfaced by <code>docker diff<\/code> .<\/p>\n<h2 id=\"viewing-content-in-the-original-image\"><span class=\"ez-toc-section\" id=\"Viewing_Content_in_the_Original_Image\"><\/span>Viewing Content in the Original Image<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>It can be helpful to compare the file version that\u2019s included in the original image. You can do this by creating a new container and then copying out the file. Use <code>docker create<\/code> instead of <code>docker run<\/code> so the container is created but not started. This will ensure that modifications caused by the image\u2019s entrypoint script don\u2019t affect the result.<\/p>\n<pre>$ docker create --name temp-container my-image:latest&#13;\n$ docker cp temp-container:\/path\/to\/file copied-file&#13;\n$ docker rm temp-container<\/pre>\n<p>An alternative way is to run the container with a custom entrypoint that emits the file\u2019s content to the standard output stream. Include the <code>--rm<\/code> flag so the container\u2019s automatically removed after the command completes:<\/p>\n<pre>$ docker run --rm --entrypoint cat alpine:latest \/path\/to\/file &gt; copied-file<\/pre>\n<h2 id=\"comparing-differences-between-two-containers\"><span class=\"ez-toc-section\" id=\"Comparing_Differences_Between_Two_Containers\"><\/span>Comparing Differences Between Two Containers<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Sometimes you might need to compare the differences between two different containers running the same image. First use <code>docker diff<\/code> to get the individual change lists:<\/p>\n<pre>$ docker diff first-container &gt; first&#13;\n$ docker diff second-container &gt; second<\/pre>\n<p>Now you can use standard Unix tools such as the <code>diff<\/code> command to find the differences in the two change lists:<\/p>\n<pre>diff first second&#13;\n3c3&#13;\n&lt; A \/a-new-file&#13;\n---&#13;\n> A \/demo<\/pre>\n<p>The diff shows that <code>\/a-new-file<\/code> has been removed in the second container while <code>\/demo<\/code> has been added.<\/p>\n<p>Another way to compare containers is to use <code>docker export<\/code> and the tar command to access a comprehensive file list:<\/p>\n<pre>$ docker export demo-container | tar tv&#13;\n-rwxr-xr-x 0\/0               0 2022-06-21 14:21 .dockerenv&#13;\ndrwxr-xr-x 0\/0               0 2022-05-23 17:51 bin\/&#13;\nlrwxrwxrwx 0\/0               0 2022-05-23 17:51 bin\/arch -&gt; \/bin\/busybox&#13;\nlrwxrwxrwx 0\/0               0 2022-05-23 17:51 bin\/ash -&gt; \/bin\/busybox&#13;\nlrwxrwxrwx 0\/0               0 2022-05-23 17:51 bin\/base64 -&gt; \/bin\/busybox&#13;\nlrwxrwxrwx 0\/0               0 2022-05-23 17:51 bin\/bbconfig -&gt; \/bin\/busybox&#13;\n...<\/pre>\n<p>Repeat this command for both your containers. You can then use <code>diff<\/code> to compare the two lists. The enhanced output of tar can help you track down when files changed as modification times and permissions are displayed.<\/p>\n<h2 id=\"summary\"><span class=\"ez-toc-section\" id=\"Summary\"><\/span>Summary<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The filesystems of Docker containers should closely resemble the image they were created from. Discrepancies can occur when software within the container writes content directly to the filesystem. Users can be another source of differences, when mechanisms such as <code>docker exec<\/code> are used to run commands within a running container.<\/p>\n<p>The <code>docker diff<\/code> utility provides a convenient way to view these changes. Although you can\u2019t see why a file was added or removed, the ability to retrieve a list of modifications can be invaluable in understanding why particular behavior is being observed.<\/p>\n<p>In this article we\u2019ve focused on examining the changes made to running containers. You can use different tools such as <code>docker history<\/code> and Dive to inspect the changes made to layers within a Docker image. The two approaches can be used in tandem, letting you work out the exact point a file was added or modified within a container\u2019s layer stack.<\/p>\n<\/div>\n<p><script>\n setTimeout(function(){\n  !function(f,b,e,v,n,t,s)\n  {if(f.fbq)return;n=f.fbq=function(){n.callMethod?\n  n.callMethod.apply(n,arguments):n.queue.push(arguments)};\n  if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';\n  n.queue=[];t=b.createElement(e);t.async=!0;\n  t.src=v;s=b.getElementsByTagName(e)[0];\n  s.parentNode.insertBefore(t,s) } (window, document,'script',\n  'https:\/\/connect.facebook.net\/en_US\/fbevents.js');\n   fbq('init', '335401813750447');\n   fbq('track', 'PageView');\n  },3000);\n<\/script><\/p>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/technology\/\" target=\"_blank\" rel=\"noopener\">Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/www.howtogeek.com\/devops\/how-to-inspect-changes-to-a-docker-containers-filesystem\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;How to Inspect Changes to a Docker Container\u2019s Filesystem&#8221; Docker containers inherit their image\u2019s filesystem upon initial creation. The container\u2019s filesystem can diverge from the image\u2019s content after creation if changes are made to the container\u2019s writable layer. The ability to inspect changes in the filesystem can help you debug issues and investigate missing data&#8230;.<\/p>\n","protected":false},"author":1,"featured_media":483359,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.howtogeek.com\/wp-content\/uploads\/2022\/05\/Docker.jpeg?height=200p&trim=2,2,2,2","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-483358","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/483358","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=483358"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/483358\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/483359"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=483358"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=483358"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=483358"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}