nsenter

Hack to "solve" Rootless Docker permission issues: nsenter -U --preserve-credentials -n -m -t $(cat $XDG_RUNTIME_DIR/docker.pid) /usr/bin/chown -R root:root /home/user/workspace This one liner enters the namespace of Rootless Docker, and does the chown back to your normal user (root is your host user when you switch back). Useful anytime you use a filesystem mount ... (Ex: storing database on disk so docker doesn't kill it every run). You can now do backups, rebuild docker images, etc. More information: https://github.com/jpetazzo/nsenter#how-do-i-use-nsenter

For running network related debug tool: use nsenter (https://github.com/jpetazzo/nsenter/blob/master/README.md) which allows you to run network related tools using the network namespace of the container. For simple shell access, use the :debug variant of distroless images which include a shell. For more complex troubleshooting, I think other people has recommended many ways. I haven't had the need to do such troubleshooting but if I need to I would mount an image with necessary binaries into the container. This is where distroless becomes handy: I can mount a Debian image and don't worry about ABI compatibility.

Sometimes, during development or when fixing a deployed app, you want to get inside the container environment to poke around. Just to work out why the hell something did or didn't happen. Right now it is difficult. Docker doesn't support it directly. There is a lot of demand for it: https://github.com/docker/docker/issues/1228 You have to use nsenter, which is OK, but requires additional installation: https://github.com/jpetazzo/nsenter It looks as though an-almost-but-not-quite-the-same thing will land in Docker at some point: https://github.com/docker/docker/pull/7409 And this shell is another attempt to make a very useful feature available.