Container sidecar shells

Wed, 18 Jun 2025 00:00:00 GMT

Having tools in a container might sometimes be useful for different debugging. Just exec into it and start the diagnostics. With a distroless/minimized image, it’s not that easy. What we can do instead is attach a sidecar container:

docker run \
  --rm \
  -it \
  --pid=container:<container id> \
  --net=container:<container id> \
  --cap-add sys_admin \
  alpine \
  sh

from: Minimal containers using Nix

This starts an Alpine container that attaches to the same PID and network namespaces, giving you visibility into what’s running inside the original container.

To make this easier, you can define a Bash function:

sidecar-sh() {
  local target_container="$1"
  local container_id
  container_id=$(docker inspect --format '{{.Id}}' "$target_container")

  docker run --rm -it \
    --pid=container:"$container_id" \
    --net=container:"$container_id" \
    --cap-add sys_admin \
    alpine sh
}

]]>

RSS Feed for containers - James Stone's Blog

Container sidecar shells