How do I run a diagnostic command inside a Docker container?
docker exec starts an additional process inside an already running container. It uses the container’s configured context and can affect the live application if you run a modifying command. Begin with a specific read-only diagnostic and use the deployment configuration for permanent changes.
Before you start
- Authorised Docker access.
- The exact running container and a diagnostic program present in its image.
Instructions
1. Check the container’s configured user
Use a targeted inspection instead of printing all environment variables. An empty configured-user field can mean the image runs as its default user, commonly root; confirm the application’s intended identity.
docker inspect --format 'status={{.State.Status}} user={{.Config.User}}' appDisplays only state and the configured user field.
2. Run one focused diagnostic
Use a program that actually exists in the image. This example asks for the current process identity and does not install software or alter application files.
docker exec app idStarts id inside the selected running container and returns its output.
3. Open a shell only when needed
If the image includes sh and an interactive investigation is authorised, open it briefly. Commands now run inside the container; exit returns to the host terminal.
docker exec -it app shStarts an interactive shell using the container’s normal configured user.
Check the result
- The command runs in the intended container with the expected identity and the application continues functioning.
Troubleshooting
- Executable sh not found
- Minimal or distroless images may intentionally omit shells. Use supported diagnostics or a separately approved debug workflow; do not modify the production image just to add a shell.
- The container is not running
- Inspect its exit state and logs first; exec cannot diagnose a stopped container by entering it.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.