977

I want to ssh or bash into a running docker container. Please, see example:

$ sudo docker run -d webserver
webserver is clean image from ubuntu:14.04
$ sudo docker ps
CONTAINER ID  IMAGE            COMMAND    CREATED STATUS  PORTS          NAMES
665b4a1e17b6  webserver:latest /bin/bash  ...     ...     22/tcp, 80/tcp loving_heisenberg 

Now I want to get something like this (go into the running container):

$ sudo docker run -t -i webserver (or maybe 665b4a1e17b6 instead)
$ root@665b4a1e17b6:/#

However when I run the line above I get new CONTAINER ID:

$ root@42f1e37bd0e5:/#

I used Vagrant and I'd like to get a similar behaviour as vagrant ssh.

2
  • alternatively sudo docker exec -i -t 665b4a1e17b6 /bin/sh to be able to install apt programs and packages Jun 9, 2018 at 20:16
  • 3
    Note that using SSH to bash into running container is poor practice – see rationale here. sudo docker exec -i -t container-name /bin/bash is a way to go. Mar 22, 2019 at 8:56

15 Answers 15

1349

The answer is Docker's attach command. So for my example above, the solution will be:

$ sudo docker attach 665b4a1e17b6 #by ID
or
$ sudo docker attach loving_heisenberg #by Name
$ root@665b4a1e17b6:/#

For Docker version 1.3 or later: Thanks to user WiR3D who suggested another way to get a container's shell. If we use attach we can use only one instance of the shell. So if we want open a new terminal with a new instance of a container's shell, we just need to run the following:

$ sudo docker exec -i -t 665b4a1e17b6 /bin/bash #by ID

or

$ sudo docker exec -i -t loving_heisenberg /bin/bash #by Name
$ root@665b4a1e17b6:/#
13
  • 5
    Alternatively, execute sudo docker attach loving_heisenberg
    – thiagowfx
    Sep 21, 2014 at 19:59
  • 58
    the attach command does not work for me, it causes the docker to freeze.. any ideas why its happening? Oct 21, 2014 at 8:32
  • 10
    A reminder for boot2docker users: remove sudo :)
    – Henno
    Dec 29, 2014 at 13:56
  • 19
    -i -t equals -it Aug 12, 2016 at 7:57
  • 52
    This is a dangerous answer to be selected and so highly voted. docker attaching to a MongoDB instance, for example, will kill the instance. As explained in more detail in this question attach and exec are different animals.
    – fred271828
    May 10, 2017 at 18:27
709

From Docker 1.3 onwards:

docker exec -it <containerIdOrName> bash

Basically, if the Docker container was started using the /bin/bash command you can access it using attach. If not, then you need to execute the command to create a Bash instance inside the container using exec.

Also to exit Bash without leaving Bash running in a rogue process:

exit

Yep, it is that simple.

11
  • still havent figured out how to get nano to work. THink that may involve docker-ssh from phusion
    – WiR3D
    Oct 29, 2014 at 13:46
  • Is there any way to set bash by default in dockers?
    – ipeacocks
    Apr 6, 2015 at 13:13
  • 11
    Using docker group is bad practice. Any user which is in docker group is essentially used with root permissions without the need to use sudo. projectatomic.io/blog/2015/08/…
    – Maiku Mori
    Mar 7, 2016 at 17:48
  • 2
    I think it doesn't make much difference, from a host security standpoint, whether you use sudo vs docker group. Either way, there is a security hole built into docker which can provide full privileges in the host file system from the guest -- regardless of whether you use the docker group or sudo to launch the container. Aug 11, 2017 at 21:39
  • 1
    @nobar when your user is in the docker group, any program you run can access the entire filesystem. that's not true if you use sudo to run docker (you'd have to enter your password first) Mar 16, 2018 at 17:07
131

Although the author of the question specifically said they are interested in a running container, it's also worth noting that if the container is not running, but you'd like to run it to poke around you can run:

docker run -i -t --entrypoint /bin/bash <imageID>

2
  • 12
    That gives a different container, just like @kraxor's answer. Sep 17, 2015 at 15:39
  • Thanks for sharing the suggestion. When I need to exit from the Image, should I use exit command?
    – Cloud Cho
    Jun 22, 2023 at 18:27
29

Try this:

sudo docker run -i -t webserver /bin/bash

Source: https://docs.docker.com/engine/reference/commandline/run/

1
  • 17
    It is not suitable, because I get different CONTAINER ID (root@42f1e37bd0e5:/# and not root@665b4a1e17b6:/#) Aug 1, 2014 at 16:31
20

Based on @Timur's answer I've created the following handy script

Setup

Put docker-ssh file in your $PATH with the following contents

#!/bin/bash -xe

# docker container id or name might be given as a parameter
CONTAINER=$1

if [[ "$CONTAINER" == "" ]]; then
  # if no id given simply just connect to the first running container
  CONTAINER=$(docker ps | grep -Eo "^[0-9a-z]{8,}\b")
fi

# start an interactive bash inside the container
# note some containers don't have bash, then try: ash (alpine), or simply sh
# the -l at the end stands for login shell that reads profile files (read man)
docker exec -i -t $CONTAINER bash -l

Note: Some container do not contain bash, but ash, sh etc. In these cases bash shall be replaced in the above script.

Usage

If you have only one running instance, simply run

$> docker-ssh 

Otherwise, provide it with a docker id parameter that you get from docker ps (first col)

$> docker-ssh 50m3r4nd0m1d
2
  • May I know why we need -l at the end?
    – Nam G VU
    Nov 24, 2017 at 6:46
  • to start bash as a login shell, reading the environment parameters ( described in the line above the command)
    – Matyas
    Nov 24, 2017 at 11:15
18

If your container doesn't have bash installed you could try sh:

docker exec -it CONTAINER /bin/sh

Or look for shells in /bin first:

docker export CONTAINER|tar -t|egrep ^bin/
0
9

I've created a containerized SSH server that provides SSH capabilities to any running container. You don't need to change your container. The only requirement is that the container has bash.

If you have a container with name 'web-server1'. The following docker run command would start a second container that would provide SSH for the first container.

docker run -ti --name sshd-web-server1 -e CONTAINER=web-server1 -p 2222:22 \
-v /var/run/docker.sock:/var/run/docker.sock -v $(which docker):/usr/bin/docker \
jeroenpeeters/docker-ssh

For more pointers, checkout https://github.com/jeroenpeeters/docker-ssh

1
6

@jpetazzo has an awesome post about this subject. The short answer would be to use nsenter:

PID=$(docker inspect --format {{.State.Pid}} <container_name_or_ID>)
nsenter --target $PID --mount --uts --ipc --net --pid

P.S.: Don't forget to check the discussion in the comments of the post...

Cheers

1
4

You can also give the Docker container a routeable IP address with Pipework, and after that SSH into the machine with that new IP address.

This will be more "traditional" (ssh), instead of using an application-specific command like docker attach, and will eventually make it more 'portable' across systems and versions.

3
  • Please, add the simples way how to do it. If to be honest, I really need it, but I have no time to search the simplest solution for that. Could you post your answer here? It would be great.. Oct 29, 2014 at 12:08
  • 2
    There are 2 ways of accomplishing this, but it isn't simple, and would become a large post. You could check out this link by yourself, for using pipework or this link, witch essentially accomplishes the same as Pipework and is a bit more simple, but you need to do it manually. So it depends about how many servers where talking. If you can't figure out something more specific, let me know. But i also don't have the time to write an full tutorial.
    – radriaanse
    Oct 29, 2014 at 12:30
  • You are right - there is no obvious and simple way to do it( Thanks for links, I think I will revisit it later. Oct 29, 2014 at 12:57
3

Sometimes it will be handy to be able to ssh into a Docker container, especially during development. The following Docker image allows to ssh into a container using a private key:

UbuntuWithSSH-Docker

The gist of the Dockerfile is https://gist.github.com/devbkhadka/98792f7bca57f9778793b2db758b3d07.

2
docker run -it openjdk:8

This works :-)

2

GOINSIDE

install goinside command line tool with:

sudo npm install -g goinside

and go inside a docker container with a proper terminal size with:

goinside docker_container_name

for more details check this out.

1

To bash into a running container, type this:

docker exec -t -i container_name /bin/bash
1
  • 1
    this is the same answer as @AdamKalnas though
    – Bruni
    Sep 6, 2016 at 17:33
0

Just for information. If you need to login in a simple container that is not a daemon, you need to use the following commands:

docker start {id}
docker attach {id}
-1

if the container is stopped like for example a data-only container then a good solution is to run a throwaway container every time you want to attach to the data container. In this case the data container itself could be entirely empty, as the temporary container would have the OS tools.

$ docker run --rm --volumes-from mydata -it ubuntu bash
root@645045d3cc87:/# ls /mydata
root@645045d3cc87:/# touch /mydata/foo
root@645045d3cc87:/# exit
exit

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .