Cant ssh into running container containing portainer through docker exec

Question

I cant connect to my running container with portainer. I tried already executing docker exec -it <CONTAINER-ID> /bin/bash. Also changed the shell path many times (/bin/sh, /usr/bin/sh, bash). Every time I get message:

OCI runtime exec failed: exec failed: container_linux.go:344: starting container process caused "exec: "/bin/bash": stat /bin/bash: no such file or directory": unknown

Container was created with command:

docker run -d -p 8000:8000 -p 9000:9000 --name=portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce

Can you tell me why I can't connect to this container only? Portainer web interface is working fine... I thought each container had access to shell, and basic tools such as ls

Answer 1

Containers may or may not include a shell, depending on how the container was built. Looking at docker hub it looks like the base image may be based on a "scratch" image, meaning that there may not be anything in the container other than the code needed to run the portainer service. The image layers here also suggest this is the case.

If you want a shell, you may want to use the portainer/portainer-ca:alpine tag. That should give you a container with a full alpine os (and the shell you are looking for). As another note, you may want to try using /bin/sh instead as not all images provide a bash shell.

Answer 2

While it is true that you can log in to most containers via /bin/bash or /bin/sh it isn't a general requirement to ship a working shell. The official portainer docker container does not have a shell for security reasons according to staff.

There are several things you can do. One would be to build your own docker container image with a Dockerfile and include a shell. If this is just for a one-off situation, you can also copy a shell (busybox looks like a good candidate) via docker cp $(which busybox) portainer:/ followed by docker exec -it portainer /busybox sh. This assumes that your running portainer container is indeed called "portainer".

Answer 3

I thought each container had access to shell, and basic tools such as ls

Only containers that have included a shell has support for a shell.