Here’s a complete tutorial on the docker diff command, explaining how it works, its purpose, and providing a comprehensive list of examples.

---

What is docker diff?

docker diff is a Docker command used to inspect changes made to the filesystem of a container. It shows the differences between the container’s current state and its original image.

Key Features:

• Lists changes to the container’s filesystem.
• Helps in debugging and auditing what files have been added, modified, or deleted in the container.
• Useful for verifying the impact of commands executed inside a running container.

---

Basic Syntax

docker diff [OPTIONS] CONTAINER

Options:

There are no specific options for docker diff. You simply provide the container name or ID.

---

Output Explanation

docker diff provides three types of changes:

• A → File or directory was added to the container.
• C → File or directory was changed (modified).
• D → File or directory was deleted from the container.

Example Output:

C /etc/hostname
A /new_file.txt
D /tmp/old_log.txt

• C /etc/hostname → /etc/hostname was modified.
• A /new_file.txt → new_file.txt was added to the container.
• D /tmp/old_log.txt → old_log.txt was deleted from /tmp.

---

Examples of docker diff

1. Check Changes in a Running Container

docker diff my_container

This command shows all changes to the my_container filesystem.

---

2. Check Changes After Modifying a File

1. Start a container: docker run -dit --name my_ubuntu ubuntu
2. Modify or create a file in the container: docker exec my_ubuntu bash -c "echo 'Hello Docker' > /tmp/hello.txt"
3. Run docker diff to check the change: docker diff my_ubuntu Output: A /tmp/hello.txt

---

3. Detect Deleted Files

1. Start a container: docker run -dit --name my_nginx nginx
2. Delete a file inside the container: docker exec my_nginx rm /etc/nginx/conf.d/default.conf
3. Run docker diff: docker diff my_nginx Output: D /etc/nginx/conf.d/default.conf

---

4. Monitor Changes in a Container’s Temporary Files

Containers often generate temporary files in /tmp or /var during operation. You can use docker diff to track these changes:

docker diff my_temp_container

This helps identify logs or cache files added during runtime.

---

5. Check Changes in a Stopped Container

You can run docker diff on both running and stopped containers:

docker diff stopped_container

---

6. Debugging File Changes in a Database Container

If you’re running a MySQL container and suspect that files in /var/lib/mysql have been modified:

docker diff my_mysql

This will list all changes in the /var/lib/mysql directory, helping you verify data persistence or accidental modifications.

---

7. Combine docker diff with Other Commands

Using docker diff with docker exec

To confirm a change detected by docker diff, use docker exec:

docker exec my_container cat /path/to/file

Using docker diff with docker commit

If you want to save a modified container after detecting changes:

docker commit my_container my_new_image

---

List of Common docker diff Commands

Command	Description
docker diff my_container	Show all changes in the container’s filesystem
docker diff stopped_container	Inspect changes in a stopped container
docker diff my_nginx	Check changes in an NGINX container
docker diff my_database	Monitor changes in a database container
docker diff container_id	Use container ID to check for filesystem changes

---

Best Practices for docker diff:

1. Use docker diff for debugging unexpected behavior in containers.
2. Combine with docker commit to create a new image from a modified container.
3. Regularly monitor changes in critical containers (e.g., databases, web servers).
4. Avoid leaving unnecessary files in containers—docker diff helps track them.

---

Common Errors and Solutions

1. “Error response from daemon: No such container”
   → Ensure the container name or ID is correct and the container exists.
2. “No changes detected”
   → This means no changes have been made since the container was created.
3. Permission Denied Errors
   → Ensure you have the necessary permissions to inspect the container.

---