How to Inspect Docker Containers: A Complete Guide

Why You’ll Want to Peek Inside Your Containers

Containers make it feel like every app lives in its own little world. That’s great for consistency, but it also means you can’t just look at what’s happening without the right tools. Whether you’re tracking down a mysterious error, confirming that an environment variable is set correctly, or just curious about the filesystem layout, inspecting a Docker container is a fundamental skill for anyone serious about containerized development.

Getting Your Hands on the Basics

Before you start opening doors, make sure Docker is up and running on your workstation. A quick docker version should show both the client and server versions without error. If you see anything strange, it’s worth fixing that first—there’s little point in digging into a container if Docker itself is misbehaving.

Docker Exec vs. Docker Inspect

• docker exec – Runs a command inside a running container, giving you an interactive shell or the output of a one‑off command.
• docker inspect – Pulls metadata about the container (configuration, networking, mount points) and returns it as JSON.

Both are useful, but they serve different needs. Use exec when you need to see the container’s live state; reach for inspect when you want the static configuration that Docker used to start it.

Peeking Inside with docker exec

Imagine you suspect a missing file in /app/config.yaml. The fastest way to confirm is:

docker exec -it my_container sh -c "cat /app/config.yaml"

The -it flags give you an interactive terminal, while sh -c runs the command inside the container’s shell. If the container uses bash instead of sh, just swap it out.

Common one‑liners you’ll end up using

• docker exec -it <id> bash – Drop into a full shell.
• docker exec <id> ps aux – See what processes are running.
• docker exec <id> env – List environment variables.

Mining Metadata with docker inspect

If you need to know the IP address Docker assigned, the exact command that launched the container, or the volumes it’s mounted, docker inspect is your go‑to. By default it spits out a sprawling JSON blob—overwhelming at first glance.

Making JSON readable

Pipe the output through jq (a lightweight JSON processor) to extract only what you care about:

docker inspect my_container | jq '.[0].NetworkSettings.IPAddress'

This returns a tidy string with the container’s IP. Swap the NetworkSettings.IPAddress path for anything else—.Config.Env for env vars, .Mounts for volume details, and so on.

Spotting Common Pitfalls

It’s easy to assume a container is running when it’s actually stopped. docker ps -a shows every container, regardless of state. Look for the “Exited” status; trying to exec into a dead container will throw an error.

Another subtle trap: using the wrong container ID. Docker accepts the full 64‑character ID, but the first few characters are usually enough—just be sure they’re unique among the list returned by docker ps. Accidentally typing a similar prefix can land you in the wrong shell.

Advanced Tricks for the Curious

If you want a snapshot of a container’s filesystem without actually entering it, consider creating a temporary image:

docker commit my_container my_snapshot
docker run -it --rm my_snapshot sh

This lets you explore the filesystem as a stand‑alone container, perfect for forensic checks.

For ongoing monitoring, combine docker stats with exec to watch memory usage while also checking logs:

docker stats my_container &
docker exec -it my_container tail -f /var/log/app.log

The ampersand runs the stats in the background, keeping your terminal free for log streaming.

Wrapping Up the Essentials

Inspecting Docker containers isn’t a single command but a toolbox. docker exec gets you inside; docker inspect tells you how the container was built; docker commit freezes a moment in time. Master these, and you’ll spend far less time guessing and far more time solving real problems.