11

I am trying to docker exec a container that is built from scratch (say, a NATS container). Seems pretty straight-forward, but since it is built from scratch, I am unable to access /bin/bash, /bin/sh and literally any such command.

I get the error: oci runtime error (command not found, file not found, etc. depending upon the command that I enter).

I tried some commands like:

docker exec -it <container name> /bin/bash
docker exec -it <container name> /bin/sh
docker exec -it <container name> ls

My question is, how do I docker exec a container that is built from scratch and consisting only of binaries? By doing a docker exec, I wish to find out if the files have been successfully copied from my host to the container (I have a COPY in the Dockerfile).

1
  • Having said that, docker run --entrypoint would do, too, since I just wish to check if the files have been copied.
    – P.K.
    Feb 16, 2019 at 7:30

5 Answers 5

15

If your scratch container is running you can copy a shell (and other needed utils) into its filesystem and then exec it. The shell would need to be a static binary. Busybox is a great choice here because it can double as so many other binaries.

Full example:

# Assumes scratch container is last launched one, else replace with container ID of
# scratch image, e.g. from `docker ps`, for example:
# scratch_container_id=401b31621b36
scratch_container_id=$(docker ps -ql)

docker run -d busybox:latest sleep 100
busybox_container_id=$(docker ps -ql)
docker cp "$busybox_container_id":/bin/busybox .

# The busybox binary will become whatever you name it (or the first arg you pass to it), for more info run:
# docker run busybox:latest /bin/busybox
# The `busybox --install` command copies the binary with different names into a directory.

docker cp ./busybox "$scratch_container_id":/busybox

docker exec -it "$scratch_container_id" /busybox sh -c '
export PATH="/busybin:$PATH"
/busybox mkdir /busybin
/busybox --install /busybin
sh'

For Kubernetes I think Ephemeral Containers provide or will provide equivalent functionality.

References: distroless java docker image error https://github.com/GoogleContainerTools/distroless/issues/168#issuecomment-371077961

2
  • Unfortunately, I still get OCI runtime exec failed: exec failed: unable to start container process: exec /busybox: no such file or directory: unknown Not sure why. I can even copy that busybox back locally and it's the same file.
    – jayreed1
    Dec 22, 2022 at 23:44
  • @jayreed1 when I see that error it's usually either because the file wasn't executable, or because it's a binary for a different architecture (e.g. ARM vs x86, or 32-bit vs 64-bit)
    – gib
    Jan 11 at 17:36
6

There are several options.

  1. You can do docker container cp ${CONTAINER}:/path/to/file/on/container /path/to/temp/dir/on/host. This will copy the files to your host where you can inspect things using host tools.
  2. You can add an appropriate VOLUME to your Dockerfile. Then you can docker container inspect ${CONTAINER}. This will expose the volume name where the files should be. You can then inspect those in another container (based off an image with all the tools you need).
  3. You can at runtime bind the container to a volume or host directory at the appropriate place.
  4. You can add those binaries that you feel you need to the image. If you need /bin/ls or /bin/sh, then you can add them.
  5. You can bind mount the necessary binaries to the container - so the container has them for verification purposes but the image is not bloated by them.
1
  • Thank you for the answer, but it does not precisely answer my question about being able to ‘docker exec’ a minimal container.
    – P.K.
    Feb 16, 2019 at 21:01
1

You can only use docker exec to run commands that actually exist in a container. If those commands don't exist, you can't run them. As you've noted, the scratch base image contains nothing – no shells, no libraries, no system files, nothing.

If all you're trying to check is if a Dockerfile COPY command actually copied the files you said it would, I'd generally assume the tooling works and just reference the copied files in my application.

Since it sounds like you control the Dockerfile, one workaround could be to change the base image to something lightweight but non-empty, like FROM busybox. That would give you a minimal set of tools that you could work with without blowing up the image size too much.

1
  • Thanks for your answer. So just to clarify, I have cloned a production repo and trying to copy files from host to container by modifying the local Dockerfile. That’s why modifying the Dockerfile to include something like busybox would not be the exact thing that would happen in production. Sure, I can use it for testing purposes, but if there is some command that I can use to test the transfer, then that would be closer to what happens in production and would be more helpful.
    – P.K.
    Feb 16, 2019 at 21:09
0

I am trying to do the same files check for my needs. I ended up with docker cp copy this file from container. In my case I am using nats container, but you can use any other container running scratch-based-image

sudo docker cp nats_nats_1:/nats-server.conf ./nats-server.conf
0

You can just grab the container identifier and throw it into a variable. For example, let's say the (truncated) output of docker ps -a is listed with your running container:

CONTAINER ID  IMAGE

111111111111   neo4j-migrator

To further the example, you can docker exec -t using the variable you created. For example:

CONTAINER_ID=`docker ps -aqf "ancestor=neo4j-migrator"`
docker exec -it $CONAINER_ID \
 sh -c "/usr/bin/neo4j-migrations \
 --password $NEO4J_PASSWORD \
 --username $NEO4J_USERNAME \
 --address $NEO4J_URI \
 migrate"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.