Exploring Docker container's file system

Exploring the Docker Container Filesystem: A Deep Dive

Understand how Docker containers manage their filesystems, including layers, storage drivers, and methods for inspection and interaction.

Docker containers provide an isolated environment for applications, and a crucial part of this isolation is their filesystem. Unlike traditional virtual machines, Docker containers leverage a layered filesystem approach, which offers significant advantages in terms of efficiency, speed, and resource utilization. This article will explore the intricacies of the Docker container filesystem, from its underlying principles to practical methods for inspecting and interacting with it.

The Layered Filesystem: Union File Systems

At the heart of Docker's efficiency is the use of Union File Systems (UFS), such as OverlayFS, AUFS, and Btrfs. These filesystems allow Docker to stack multiple read-only layers on top of a base image, with a single writable layer on top for container-specific changes. This architecture means that when you build a Docker image, each instruction in your Dockerfile creates a new read-only layer. When a container is launched from that image, Docker adds a thin, writable layer on top. All changes made by the running container (e.g., creating files, modifying existing ones) are written to this top layer, leaving the underlying image layers untouched.

graph TD
    A[Base Image Layer 1 (Read-Only)] --> B[Image Layer 2 (Read-Only)]
    B --> C[Image Layer 3 (Read-Only)]
    C --> D[Container Writable Layer]
    D --> E["Running Container (Changes here)"]

Simplified representation of Docker's layered filesystem

This layered approach has several benefits:

• Efficiency: Layers are shared between containers. If multiple containers use the same base image, they share the underlying read-only layers, saving disk space.
• Speed: Building new images is faster because Docker only needs to build new layers for changes, reusing existing ones.
• Immutability: The base image remains unchanged, ensuring consistency and making it easy to revert to a previous state.
• Version Control: Each layer can be thought of as a commit in a version control system, making it easy to track changes.

Inspecting and Interacting with Container Filesystems

Understanding the layered filesystem is one thing, but knowing how to inspect and interact with it is crucial for debugging and development. Docker provides several commands to help you explore the filesystem of both images and running containers.

docker inspect <container_id_or_name> --format='{{ .GraphDriver.Data.MergedDir }}'

Find the merged directory path for a running container's filesystem on the host.

The docker inspect command is incredibly powerful for retrieving low-level information about Docker objects. By filtering the output, you can find the actual path on the host machine where the container's merged filesystem is mounted. This path typically points to a directory managed by the storage driver (e.g., /var/lib/docker/overlay2/<hash>/merged). However, directly modifying files in this directory is generally discouraged as it can lead to inconsistencies.

docker exec -it <container_id_or_name> /bin/bash
# Once inside the container:
ls -l /
cat /etc/os-release

Accessing a running container's shell to explore its filesystem.

For a safer and more common approach, you can use docker exec to run commands inside a running container, including launching a shell. This allows you to navigate and inspect the filesystem from the container's perspective, just as you would on a regular Linux system.

Copying Files In and Out of Containers

Sometimes you need to move files between your host machine and a container. Docker provides the docker cp command for this purpose, which is similar to the scp command for remote systems.

# Copy a file from host to container
docker cp /path/to/host/file.txt <container_id_or_name>:/path/in/container/

# Copy a file from container to host
docker cp <container_id_or_name>:/path/in/container/file.txt /path/to/host/

Using docker cp to transfer files between host and container.

For persistent data or sharing data between the host and container, Docker volumes are the recommended solution. Volumes bypass the layered filesystem and store data directly on the host, making it independent of the container's lifecycle.

flowchart LR
    Host[Host Machine] -- "docker cp" --> Container[Docker Container]
    Container -- "docker cp" --> Host
    Host -- "Mounts" --> Volume[Docker Volume]
    Volume -- "Persistent Data" --> Container

Data transfer and persistence mechanisms in Docker