Docker Cookbook

4.5 Using nsenter
Problem
You would like to enter a container for debugging purposes, you are using a Docker
version older than 1.3.1, or you do not want to use the 
docker exec
command.
4.5 Using nsenter | 113

---

Solution
Use 
nsenter
. Starting with Docker 1.3, 
docker exec
allows you to easily enter a run‐
ning container, so there is no need to do things like running an SSH server and
exposing port 22 or using the now deprecated 
attach
command.
nsenter
was created to solve the problem of entering the namespace (hence, 
nsenter
)
of a container prior to the availability of 
docker exec
. Nonetheless, it is a useful tool
that merits a short recipe in this book.
Let’s start a container that sleeps for the duration of this recipe, and for completeness,
let’s enter the running container with 
docker exec
:
$ docker pull ubuntu:14.04
$ docker run -d --name sleep ubuntu:14.04 sleep 300
$ docker exec -ti sleep bash
root@db9675525fab:/#
nsenter
gives the same result. Conveniently, it comes as an image in Docker Hub.
Pull the image, run the container, and use 
nsenter
.
$ docker pull jpetazzo/nsenter
$ sudo docker run docker run --rm -v /usr/local/bin:/target jpetazzo/nsenter
At this time, it is useful to have a look at the 
Dockerfile
 for 
nsenter
and check the 
CMD
option. You will see that it runs a script called 
installer
. This small bash script does
nothing but detect whether a mount point exists at 
/target
. If it does, it copies a script
called 
docker-enter
and a binary called 
nsenter
to that mount point. In the 
docker run
command, since you specified a volume (i.e., 
-v /usr/local/bin:/target
), running
the container will have the effect of copying 
nsenter
on your local machine. Quite a
nice trick with a powerful effect:
$ which docker-enter nsenter
/usr/local/bin/docker-enter
/usr/local/bin/nsenter
To copy the files in 
/usr/local/bin
, I run the container with 
sudo
. If
you do not want to use this mount-point convenience, you can
copy the files locally with a command like this:
$ docker run --rm jpetazzo/nsenter cat /nsenter \
> /tmp/nsenter && chmod +x /tmp/nsenter
You are now ready to enter the container. You can pass a command, if you do not
want to get an interactive shell in the container:
$ docker-enter sleep
root@db9675525fab:/#
$ docker-enter sleep hostname
db9675525fab