Docker - Containers & Shells

---

---

Shells are essential in Docker containers; they act as interfaces through which the execution of commands in the container occurs. Usually, when a container is started, it has to run a shell to interpret and execute the commands either described in the Dockerfile or passed when the container is run.

The shell performs several vital functions −

• Command Execution − Shells interpret and execute commands authored in scripts or entered interactively by users. This includes software installation, environment configuration, and application execution.
• Script Automation − One of the biggest roles shell scripts play in Dockerfiles is the automation of the container environment setup. It ensures that all essential steps are automatically and consistently executed.
• Interactive Access − Shells enable interactive access to containers, allowing developers and admins to debug, manage, and examine the container's environment. This is done interactively by running commands, for instance, docker exec, against a running container to have a shell session opened inside it.

Types of Shells Commonly Used in Docker

There are quite a few types of shells being used in Docker containers with different features and advantages −

Bash (Bourne Again Shell)

• Default Shell − Bash is the default shell for most Linux distributions and is, by a wide margin, the most used among Docker containers.
• Scripting − It has extensive scripting, from variables and loops to conditionals and functions.
• Rich Functionality − Bash provides features such as command history, job control, and tab completion that enhance interactive use.

Sh (Bourne Shell)

• Simplicity − Sh is a very simple shell compared to Bash. It is the original Unix shell and is available on almost all Unix-like systems.
• Portability − Sh scripts are highly portable and can run on virtually any Unix-like operating system.
• Fewer Features − It is not quite as featureful as bash, but that allows scripts to be generally easier to write portably.

Zsh (Z Shell)

• Advanced Features − It has most of the advanced features that are absent in Bash, like better tab completions, extensive scripting capabilities, and highly customizable prompts.
• Customization − It is highly customizable, allowing users to tailor the shell environment to their preferences.
• Popularity − With its powerful features and customization, Zsh has become especially popular among developers.

Accessing Shells with in Docker Containers

Lets understand the different ways to access shells within Docker Containers.

Docker exec Command (Interactive and Detached Modes)

One of the best ways of accessing and interacting with running Docker containers is through the docker exec command. It allows for the starting of a new process inside an existing container, hence allowing the execution of commands or even opening an interactive shell session.

Interactive Mode

The docker exec command is used with the flags -it to access a shell available inside a running container interactively. In this case, -i means interactive, and -t allocates a pseudo-TTY. In this way, a user can interact with a shell as if they were really logged in.

Example command to run a Bash shell inside a container that is already running −

$ docker exec -it <container_id> /bin/bash

In the above example, replace <container_id> with the actual running Container ID or Name. This will drop the User into a real-time Bash shell within the Container for interaction and command execution.

Detached Mode

Besides that, docker exec can also accept the option to do things in a detached way - executing the command but without attaching the user to the process. This is great for all background processing or non-interactive commands within the container.

Example detached process command −

$ docker exec -d <container_id> <command>

In this example, <command> is the command you want to run inside the container, and since we've used -d, the command will be run in the background with your command line detached from the process.

docker run -it (Interactive Terminal at Container Start)

You can use a docker run -it command when you want to initiate a new container and with an interactive way of opening a terminal session within it. This can be very practical when debugging, testing, or configuring new containers interactively from its creation.

Example command to launch a new container with an interactive shell in Bash −

$ docker run -it <image_name> /bin/bash

In the above example, in <image_name>, you have to include the name of the Docker image you want to be created the container from. The option -it then makes the interactive and pseudo-TTY allocation mode, allowing the user to interact directly with the container.

nsenter and Other Low-Level Tools

nsenter is a low-level Linux utility to access the namespaces of a running process. Docker containers use Linux namespaces as isolation; nsenter is used to enter into these namespaces and thus get access to the environment lying inside the container.

Example command to enter the namespaces of a container using nsenter −

1. First off, get the PID of the main process running in the container −

$ docker inspect --format "{{.State.Pid}}" <container_id>

2. Use nsenter to gain access to the namespaces of the container −

$ nsenter --target <pid> --mount --uts --ipc --net --pid /bin/bash

In this example, replace <pid> with the PID you got in the first step. This will open a bash inside the namespaces of the container with full access to the environment of the container.

Using Docker Desktop with Shell Access(GUI)

Docker Desktop is a convenience for the macOS and Windows operating systems in a way that it provides a graphical user interface to work with Docker containers. As a result, much of what may be complex work in Docker CLI, such as opening a shell into a container, is simplified through its GUI.

To access a shell using Docker Desktop −

• Open Docker Desktop − Start the Docker Desktop application from your applications menu.
• View Containers − Click the "Containers/Apps" tab to view a running container listing.
• Open Terminal − Simply click on the container you want to connect to and then click the "CLI" or "Terminal" button. This will open a new terminal window attached to the container, usually with a Bash shell inside.

Running Containers as Non-Root Users

Containers run as non-root users is a necessary security practice. Docker containers run, by default, as the root user. Doing so would lead to a high level of risk if an attacker gained entrance to the container. Running minimum necessary permissions inside the container helps to reduce potential damage.

Best Practices

Create Non-Root Users − Define non-root users in your Dockerfile using the USER instruction. For example −

FROM ubuntu:latest
RUN useradd -m nonrootuser
USER nonrootuser

Restrict Capabilities − Limit the capabilities of the container by using Docker's --cap-drop and --cap-add options to drop unnecessary privileges.

File System Permissions − Ensure file system permissions are correctly set to prevent unauthorized access to sensitive files and directories.

Conclusion

In this chapter, we have discussed how to access container shells. We looked at the different types of shells and the commands to access each of them. These commands are useful if you want to inspect whats happening inside Docker containers or if you want to run commands in Containers.

FAQs on Docker Containers & Shells

1. What should I do if the docker container doesn't have a shell?

Sometimes container images are left without a shell on purpose to keep the image size small. In this case, you can do the following: Commit the running container with a new layer where the shell is installed, and then start a new container based on this modified image.

You can use the Docker cp command or copy the shell binary to the container in other ways. More advanced is using nsenter to access the existing container's namespaces relatively directly.

2. Are there any Alternatives to Accessing Docker Container Shells?

Yes, there are other ways to interact with containers besides direct access. For example, one can view container output by making use of docker logs, inspect container details by using docker inspect, or check the resource usage by using docker stats.

Dedicated tools like docker exec with a debugger attached enable such debugging possibilities or via strace and gdb when there is a necessity for in-depth analysis of running processes. Ultimately, the best approach will be based on your needs and how much access is needed for your task.