Beginner LevelDocker & Deployment
What does docker diff show for a running container instance?
❓ Interview Prompt: Explain how docker diff reveals filesystem changes in a container writable layer compared to its base image.
`docker diff` compares the container's writable layer against its base image and lists all filesystem changes that have occurred since the container started.
Change Type Codes:
•
`A` — File or directory was Added (new, not in the base image).
•
`C` — File or directory was Changed (modified content or metadata).
•
`D` — File or directory was Deleted.
Use Cases:
1
Debugging: Understand what an application wrote to disk (log files, cache, temp files).
2
Security Auditing: Detect unexpected file system modifications (potential malware or misconfiguration).
3
Image Creation Analysis: Understand what a
docker commit would capture.4
Troubleshooting Crashes: Identify config files modified at runtime that caused failures.
Important Note:
Changes shown by docker diff exist only in the container's writable layer. They are lost when the container is removed unless you use a Volume or docker commit.
Code Implementation Example
bash
# Start a container and make some changes inside
docker run -d --name mytest alpine sh -c "sleep 3600"
docker exec mytest sh -c "echo 'hello' > /tmp/test.txt && rm /etc/hostname"
# Show all filesystem changes vs base image
docker diff mytest
# C /tmp ← directory changed (new file added)
# A /tmp/test.txt ← new file Added
# D /etc/hostname ← file Deleted
# C /etc/hosts ← Docker always modifies /etc/hosts
# Security audit: look for unexpected writes outside /tmp
docker diff myapp | grep -v '^C /tmp' | grep -v '^C /var/log'
# Any 'A' or 'C' outside expected paths = investigate!
# Note: Changes are LOST when container is removed
docker rm -f mytest # /tmp/test.txt gone forever💡docker diff reveals A(dded), C(hanged), D(eleted) files in the container writable layer vs base image.
🎯 Interview Key Takeaway
docker diff reveals A/C/D filesystem changes in the container writable layer — useful for security auditing unexpected modifications.
#Docker#docker diff#Filesystem#Security#Debugging#Beginner
Back to all Docker & Deployment Questions→