Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Getting a Shell in the Docker Desktop Mac VM

2021 Update: Easiest option is Justin's repo and image

Just run this from your Mac terminal and it'll drop you in a container with full permissions on the Docker VM. This also works for Docker for Windows for getting in Moby Linux VM (doesn't work for Windows Containers).

docker run -it --rm --privileged --pid=host justincormack/nsenter1

more info:

Option 1 (hard way): use netcat

nc -U ~/Library/Containers/com.docker.docker/Data/debug-shell.sock

Exit the shell with exit.

Option 2 (easier): Use nsenter in priviledged container

docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh

Phil Estes (Docker Maintainer) says:

it’s running a container (using the debian image. nothing special about it other than it apparently has nsenter installed), with pid=host (so you are in the process space of the mini VM running Docker4Mac), and then nsenter says “whatever is pid 1, use that as context, and enter all the namespaces of that, and run a shell there"

Option 3 (easist): run nsenter from a pre-built image. From Justin Cormack (Docker Maintainer)

docker run -it --rm --privileged --pid=host justincormack/nsenter1

Copy link

ssx commented Mar 12, 2017

Just a quick note, if you've created the machine with docker-machine, you can ssh in using docker-machine ssh (that name can be found by docker-machine ls)

Copy link

Zaijo commented Jul 13, 2017

Hello, thanks for sharing. What version of Docker are you useing here? I have

Version 17.06.0-ce-mac18 (18433)
Channel: stable

And I get some strange results when running screen ~/Library/Containers/com.docker.docker/Data/com.docker.driver.amd64-linux/tty it just opens my ordinary screen empty windows.

Copy link

sandinmyjoints commented Oct 20, 2017

@Zaijo because you're connecting to a tty, not logging in, you won't see a prompt initially. Try typing a command and hitting enter -- you'll see the output and then a new prompt.

Copy link

webguywalker commented Aug 1, 2018

💯 legit

Copy link

jzelinskie commented Sep 25, 2018

the tty for screen got moved to $HOME/Library/Containers/com.docker.docker/Data/vms/0/tty

Copy link

rfay commented Jan 20, 2019

the tty for screen got moved to $HOME/Library/Containers/com.docker.docker/Data/vms/0/tty

@BretFisher could you please update the body to account for the move of the tty? It will save people debugging it or giving up and then reading down to - Thanks!

Copy link

vocatan commented Feb 22, 2019

The 2nd method to attach, using docker run -it --rm --privileged --pid=host justincormack/nsenter1 "just works" reliably.

I've observed that when using screen to attach to the tty, occasionally the output will get corrupted. In this case, I can't seem to reset it back using the normal 'unix-y' tricks like 'reset', 'stty sane', 'Ctl-a Z', or such. From the output of pstree, and typing the command 'sleep 100', I can see that my commands are making it through, just the output being somehow not rendered.

Curious if there is anyone knew the cause for this -- but happy to have this universal solution

Copy link

mkhafaga commented Apr 18, 2019

@vocatan: The output gets corrupted because you opened different screen sessions.

Copy link

stasbamiza commented Jun 23, 2019

the tty for screen got moved to $HOME/Library/Containers/com.docker.docker/Data/vms/0/tty

@jzelinskie Many tanks bro 😄 👍 ❤️

Copy link

BretFisher commented Jun 24, 2019

Thanks @jzelinskie for the tty location, @rfay for the reminder to update this gist, and @Stas0 for a re-reminder. Only took 9 months to update 🙄 but hey I think we all agree that docker run -it --rm --privileged --pid=host justincormack/nsenter1 is the best way to go.

Copy link

tamsky commented Sep 30, 2019

Anyone have any tips for getting sshd running on the Moby Linux VM?

Copy link

yihuang commented Jul 31, 2020

I get "permission denied" when trying to run screen ~/Library/Containers/com.docker.docker/Data/vms/0/tty.
MacOS 11.15.6, docker desktop
docker run -it --rm --privileged --pid=host justincormack/nsenter1 works though.

Copy link

chinaq commented Aug 4, 2020

I get "permission denied" when trying to run screen ~/Library/Containers/com.docker.docker/Data/vms/0/tty.
MacOS 11.15.6, docker desktop
docker run -it --rm --privileged --pid=host justincormack/nsenter1 works though.

So do I.

Copy link

HKITYAN commented Aug 9, 2020

I get "permission denied" when trying to run screen ~/Library/Containers/com.docker.docker/Data/vms/0/tty.
MacOS 11.15.6, docker desktop
docker run -it --rm --privileged --pid=host justincormack/nsenter1 works though.

Same issue. After some trials, able to connect to the the vm using `screen /dev/ttys000. You have to check the where does the tty file (~/Library/Containers/com.docker.docker/Data/vms/0/tty) points to?

Copy link

raghavkarol commented Aug 27, 2020

+1 and thanks to @HKITYAN. It seems like docker this recently. I updated docker yesterday and screen ~/Library/Containers/com.docker.docker/Data/vms/0/tty stopped connecting.

Copy link

mjaverto commented Sep 5, 2020

To fix screen tty:

  • Make the tty file readable: chmod 400 ~/Library/Containers/com.docker.docker/Data/vms/0/tty
  • Do not try to execute that file, but read its contents: screen $(cat ~/Library/Containers/com.docker.docker/Data/vms/0/tty)

Copy link

tjbaker commented Oct 1, 2020

@mjaverto the cat suggestion seems to no longer work with the latest (48506) version of Docker Desktop. :-(

Copy link

demisx commented Oct 7, 2020

@mjaverto the cat suggestion seems to no longer work with the latest (48506) version of Docker Desktop. :-(

Yes, the new version has changed some things around. We need to figure out a new way. Hopefully, as simple as with minikube.

Copy link

demisx commented Oct 7, 2020

Here is one way to get a shell in v2.4.0.0+:

$ nc -U ~/Library/Containers/com.docker.docker/Data/debug-shell.sock .

Copy link

macloy commented Oct 14, 2020

I get a shell. But how can ich change a file with vi? When I press the "Esc"-Key I get signs like "^[" this. And I have no statusline at the bottom. Or any other method to change a file in this shell?

Copy link

tatsushid commented Oct 16, 2020

I can use the debug shell normally in this way

  1. Open debug-shell.sock by socat command with pty endpoint
  2. Open the pty with screen command
$ socat -d -d ~/Library/Containers/com.docker.docker/Data/debug-shell.sock pty,rawer # it should show "PTY is /dev/ttys0xx" like line.
$ screen /dev/ttys0xx

Copy link

deeTEEcee commented Dec 3, 2020

thanks for this. i went through a deep rabbit hole due to broken, dead containers and really felt like it was important to delete them and was finally able to do that with this available.

EDIT: TIL about colima I might give that a shot as an alternative to Docker Desktop to see if that works better for me.

Copy link

rabbot commented Jan 7, 2021

Just like to poke around. Put this in a shell script.

$(socat -d -d ~/Library/Containers/com.docker.docker/Data/debug-shell.sock pty,rawer 2>&1 | grep -Eo --line-buffered "/dev/tty\w+" > ${TTY_TMP} ) &
sleep 2
TTY=$(tail -n 1 "${TTY_TMP}")
picocom $TTY 2>/dev/null

Copy link

hastiAu commented Jan 7, 2021

I have an image for sql on mac
then i create a volume :dbdata
now I want to mount it with this command:
docker run -v /var/folders:/var/opt/mssql/data

but i see this error :
SQL Server 2019 will run as non-root by default.
This container is running as user mssql.

how do i do ?

Copy link

51enra commented Jan 22, 2021

Regarding the "2021 Update":
It's no longer necessary to use Justin Cormack's modification; the outstanding issue he mentions seems to be resolved. The first option he gives in his repo works just fine:
docker run -it --rm --privileged --pid=host alpine:edge nsenter -t 1 -m -u -n -i sh

Copy link

KishoreNamala commented May 8, 2021

how do we exit out of the terminal opened by the screen command ? I keep getting a new shell prompt in docker desktop

Copy link

explogx commented Jan 8, 2022

The shell obtained by opening debug-shell.sock is very limited as it's a busybox executable. You can try to access the regular VM console with: socat ~/Library/Containers/com.docker.docker/Data/vms/0/console.sock -,rawer (exit by closing the terminal window as the prompt is configured to auto login).

Copy link

bcoughlan commented Jul 12, 2022

Here's an example of how to install packages on the VM (htop in this case):

docker run -it --rm --privileged --pid=host justincormack/nsenter
$ mount -o remount,rw /
$ mkdir /var/cache/apk
$ apk add htop

Copy link

zwass commented Jul 26, 2022

docker run -it --rm --privileged --pid=host alpine:edge nsenter -t 1 -m -u -n -i sh as suggested in justincormack/nsenter seems to work just fine with Docker Desktop 4.10.1 on macOS.

Copy link

rimelek commented Aug 23, 2022

I just want to say thanks to @BretFisher and also everyone who commented, because using these suggested commands helped me to understend Docker Desktop more. I started to use console.sock, because I didn't know what was the difference between that and the debug shell. Then I realized when I intentionally broke my Docker Desktop and started to see logs in the console, but not in the debug shell. :) It was useful while I was working on a new tutorial.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment