Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Getting a Shell in the Docker for Mac Moby VM

2018 Update: Easiest option is Justin's repo and image

Just run this from your Mac terminal and it'll drop you in a container with full permissions on the Moby VM. This also works for Docker for Windows for getting in Moby Linux VM (doesn't work for Windows Containers).

docker run -it --rm --privileged --pid=host justincormack/nsenter1

more info: https://github.com/justincormack/nsenter1


Option 1: use Screen (not as easy as nsenter)

Note this isn't a list of commands to run in order. The first one gets you in the VM (hit return twice to see a prompt). Then other commands are for managing that connection. Not a great CLI expirence but gets the job done. Using the ctrl- options prevents garbled text on reconnect.

connect to tty on Docker for Mac VM

screen ~/Library/Containers/com.docker.docker/Data/vms/0/tty

disconnect that session but leave it open in background

Ctrl-a d

list that session that's still running in background

screen -ls

reconnect to that session (don't open a new one, that won't work and 2nd tty will give you garbled screen)

screen -r

kill this session (window) and exit

Ctrl-a k

Option 2 (easier): Use nsenter in priviledged container

docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh

Phil Estes (Docker Maintainer) says:

it’s running a container (using the debian image..nothing special about it other than it apparently has nsenter installed), with pid=host (so you are in the process space of the mini VM running Docker4Mac), and then nsenter says “whatever is pid 1, use that as context, and enter all the namespaces of that, and run a shell there"

Or even easier, from Justin Cormack (Docker Maintainer)

docker run -it --rm --privileged --pid=host justincormack/nsenter1

Justin Says:

Personally I mostly use screen, but then I also use the above too. That's my minimal nsenter image.

@ssx

This comment has been minimized.

Copy link

@ssx ssx commented Mar 12, 2017

Just a quick note, if you've created the machine with docker-machine, you can ssh in using docker-machine ssh (that name can be found by docker-machine ls)

@Zaijo

This comment has been minimized.

Copy link

@Zaijo Zaijo commented Jul 13, 2017

Hello, thanks for sharing. What version of Docker are you useing here? I have

Version 17.06.0-ce-mac18 (18433)
Channel: stable
d9b66511e0

And I get some strange results when running screen ~/Library/Containers/com.docker.docker/Data/com.docker.driver.amd64-linux/tty it just opens my ordinary screen empty windows.

@sandinmyjoints

This comment has been minimized.

Copy link

@sandinmyjoints sandinmyjoints commented Oct 20, 2017

@Zaijo because you're connecting to a tty, not logging in, you won't see a prompt initially. Try typing a command and hitting enter -- you'll see the output and then a new prompt.

@webguywalker

This comment has been minimized.

Copy link

@webguywalker webguywalker commented Aug 1, 2018

💯 legit

@jzelinskie

This comment has been minimized.

Copy link

@jzelinskie jzelinskie commented Sep 25, 2018

the tty for screen got moved to $HOME/Library/Containers/com.docker.docker/Data/vms/0/tty

@rfay

This comment has been minimized.

Copy link

@rfay rfay commented Jan 20, 2019

the tty for screen got moved to $HOME/Library/Containers/com.docker.docker/Data/vms/0/tty

@BretFisher could you please update the body to account for the move of the tty? It will save people debugging it or giving up and then reading down to https://gist.github.com/BretFisher/5e1a0c7bcca4c735e716abf62afad389#gistcomment-2716295 - Thanks!

@vocatan

This comment has been minimized.

Copy link

@vocatan vocatan commented Feb 22, 2019

The 2nd method to attach, using docker run -it --rm --privileged --pid=host justincormack/nsenter1 "just works" reliably.

I've observed that when using screen to attach to the tty, occasionally the output will get corrupted. In this case, I can't seem to reset it back using the normal 'unix-y' tricks like 'reset', 'stty sane', 'Ctl-a Z', or such. From the output of pstree, and typing the command 'sleep 100', I can see that my commands are making it through, just the output being somehow not rendered.

Curious if there is anyone knew the cause for this -- but happy to have this universal solution

@mkhafaga

This comment has been minimized.

Copy link

@mkhafaga mkhafaga commented Apr 18, 2019

@vocatan: The output gets corrupted because you opened different screen sessions.

@stasbamiza

This comment has been minimized.

Copy link

@stasbamiza stasbamiza commented Jun 23, 2019

the tty for screen got moved to $HOME/Library/Containers/com.docker.docker/Data/vms/0/tty

@jzelinskie Many tanks bro 😄 👍 ❤️

@BretFisher

This comment has been minimized.

Copy link
Owner Author

@BretFisher BretFisher commented Jun 24, 2019

Thanks @jzelinskie for the tty location, @rfay for the reminder to update this gist, and @Stas0 for a re-reminder. Only took 9 months to update 🙄 but hey I think we all agree that docker run -it --rm --privileged --pid=host justincormack/nsenter1 is the best way to go.

@tamsky

This comment has been minimized.

Copy link

@tamsky tamsky commented Sep 30, 2019

Anyone have any tips for getting sshd running on the Moby Linux VM?

@yihuang

This comment has been minimized.

Copy link

@yihuang yihuang commented Jul 31, 2020

I get "permission denied" when trying to run screen ~/Library/Containers/com.docker.docker/Data/vms/0/tty.
MacOS 11.15.6, docker desktop 2.3.0.4.
docker run -it --rm --privileged --pid=host justincormack/nsenter1 works though.

@chinaq

This comment has been minimized.

Copy link

@chinaq chinaq commented Aug 4, 2020

I get "permission denied" when trying to run screen ~/Library/Containers/com.docker.docker/Data/vms/0/tty.
MacOS 11.15.6, docker desktop 2.3.0.4.
docker run -it --rm --privileged --pid=host justincormack/nsenter1 works though.

So do I.

@HKITYAN

This comment has been minimized.

Copy link

@HKITYAN HKITYAN commented Aug 9, 2020

I get "permission denied" when trying to run screen ~/Library/Containers/com.docker.docker/Data/vms/0/tty.
MacOS 11.15.6, docker desktop 2.3.0.4.
docker run -it --rm --privileged --pid=host justincormack/nsenter1 works though.

Same issue. After some trials, able to connect to the the vm using `screen /dev/ttys000. You have to check the where does the tty file (~/Library/Containers/com.docker.docker/Data/vms/0/tty) points to?

@raghavkarol

This comment has been minimized.

Copy link

@raghavkarol raghavkarol commented Aug 27, 2020

+1 and thanks to @HKITYAN. It seems like docker this recently. I updated docker yesterday and screen ~/Library/Containers/com.docker.docker/Data/vms/0/tty stopped connecting.

@mjaverto

This comment has been minimized.

Copy link

@mjaverto mjaverto commented Sep 5, 2020

To fix screen tty:

  • Make the tty file readable: chmod 400 ~/Library/Containers/com.docker.docker/Data/vms/0/tty
  • Do not try to execute that file, but read its contents: screen $(cat ~/Library/Containers/com.docker.docker/Data/vms/0/tty)
@tjbaker

This comment has been minimized.

Copy link

@tjbaker tjbaker commented Oct 1, 2020

@mjaverto the cat suggestion seems to no longer work with the latest 2.4.0.0 (48506) version of Docker Desktop. :-(

@demisx

This comment has been minimized.

Copy link

@demisx demisx commented Oct 7, 2020

@mjaverto the cat suggestion seems to no longer work with the latest 2.4.0.0 (48506) version of Docker Desktop. :-(

Yes, the new version has changed some things around. We need to figure out a new way. Hopefully, as simple as with minikube.

@demisx

This comment has been minimized.

Copy link

@demisx demisx commented Oct 7, 2020

Here is one way to get a shell in v2.4.0.0+:

$ nc -U ~/Library/Containers/com.docker.docker/Data/debug-shell.sock .
@macloy

This comment has been minimized.

Copy link

@macloy macloy commented Oct 14, 2020

I get a shell. But how can ich change a file with vi? When I press the "Esc"-Key I get signs like "^[" this. And I have no statusline at the bottom. Or any other method to change a file in this shell?

@tatsushid

This comment has been minimized.

Copy link

@tatsushid tatsushid commented Oct 16, 2020

I can use the debug shell normally in this way

  1. Open debug-shell.sock by socat command with pty endpoint
  2. Open the pty with screen command
$ socat -d -d ~/Library/Containers/com.docker.docker/Data/debug-shell.sock pty,rawer # it should show "PTY is /dev/ttys0xx" like line.
$ screen /dev/ttys0xx
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.