Answers: <p>The <a href="https://docs.docker.com/engine/reference/commandline/container_diff/" rel="nofollow noreferrer"><code>docker container diff</code></a> command shows the differences between a container and its base system.</p>
  
  <p>In the output, files are reported as (A) if the file or directory was added, (D) if a file or directory was deleted or (C) if a file or directory was changed. File permission changes are reported as (C).</p>
  
  <pre><code>she$ CID=$(sudo docker run --rm -d ubuntu sleep 500)
  sh$ sudo docker exec $CID touch newfile
  sh$ sudo docker exec $CID useradd bob
  sh$ sudo docker exec $CID chmod o-x /usr/bin/cut
  sh$ sudo docker diff $CID
  C /etc
  C /etc/group
  A /etc/group-
  C /etc/gshadow
  A /etc/gshadow-
  C /etc/passwd
  A /etc/passwd-
  C /etc/shadow
  A /etc/shadow-
  C /etc/subgid
  A /etc/subgid-
  C /etc/subuid
  A /etc/subuid-
  A /newfile
  C /usr
  C /usr/bin
  C /usr/bin/cut
  C /var
  C /var/log
  C /var/log/faillog
  C /var/log/lastlog
  C /var/log/tallylog
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2019-02-12T19:56:53.633Z
Answers: 2019-02-12T19:56:53.633Z
Answers: Sylvain Leroux
Body: <p>Is there a way to know which files have changed in a docker container compared to its base image?</p>
  
  <p>I am looking both for file creation/modification/deletion, but also for metadata change like file permissions.</p>
  
Tags: <docker><audit>
Title: Is there a way to know which files have changed in a docker container compared to its base image?
UserDisplayName: Sylvain Leroux
ThreadText: # Is there a way to know which files have changed in a docker container compared to its base image?
  
  (Asked by: username_0 on 2019-02-12)
  
  Is there a way to know which files have changed in a docker container compared to its base image?
  
  I am looking both for file creation/modification/deletion, but also for metadata change like file permissions.
  
  **Tags:** docker, audit
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2019-02-12. Score: 3 | Accepted answer
  
  The [`docker container diff`](https://docs.docker.com/engine/reference/commandline/container_diff/) command shows the differences between a container and its base system.
  
  In the output, files are reported as (A) if the file or directory was added, (D) if a file or directory was deleted or (C) if a file or directory was changed. File permission changes are reported as (C).
  
  ```
  she$ CID=$(sudo docker run --rm -d ubuntu sleep 500)
  sh$ sudo docker exec $CID touch newfile
  sh$ sudo docker exec $CID useradd bob
  sh$ sudo docker exec $CID chmod o-x /usr/bin/cut
  sh$ sudo docker diff $CID
  C /etc
  C /etc/group
  A /etc/group-
  C /etc/gshadow
  A /etc/gshadow-
  C /etc/passwd
  A /etc/passwd-
  C /etc/shadow
  A /etc/shadow-
  C /etc/subgid
  A /etc/subgid-
  C /etc/subuid
  A /etc/subuid-
  A /newfile
  C /usr
  C /usr/bin
  C /usr/bin/cut
  C /var
  C /var/log
  C /var/log/faillog
  C /var/log/lastlog
  C /var/log/tallylog
  
  ```
  
  
  ---
  
  