<p>The <a href="https://docs.docker.com/engine/reference/commandline/container_diff/" rel="nofollow noreferrer"><code>docker container diff</code></a> command shows the differences between a container and its base system.</p>

<p>In the output, files are reported as (A) if the file or directory was added, (D) if a file or directory was deleted or (C) if a file or directory was changed. File permission changes are reported as (C).</p>

<pre><code>she$ CID=$(sudo docker run --rm -d ubuntu sleep 500)
sh$ sudo docker exec $CID touch newfile
sh$ sudo docker exec $CID useradd bob
sh$ sudo docker exec $CID chmod o-x /usr/bin/cut
sh$ sudo docker diff $CID
C /etc
C /etc/group
A /etc/group-
C /etc/gshadow
A /etc/gshadow-
C /etc/passwd
A /etc/passwd-
C /etc/shadow
A /etc/shadow-
C /etc/subgid
A /etc/subgid-
C /etc/subuid
A /etc/subuid-
A /newfile
C /usr
C /usr/bin
C /usr/bin/cut
C /var
C /var/log
C /var/log/faillog
C /var/log/lastlog
C /var/log/tallylog
</code></pre>

CC BY-SA 4.0
2019-02-12T19:56:53.633Z
2019-02-12T19:56:53.633Z
Sylvain Leroux
<p>Is there a way to know which files have changed in a docker container compared to its base image?</p>

<p>I am looking both for file creation/modification/deletion, but also for metadata change like file permissions.</p>

<docker><audit>
Is there a way to know which files have changed in a docker container compared to its base image?
Sylvain Leroux
# Is there a way to know which files have changed in a docker container compared to its base image?

(Asked by: username_0 on 2019-02-12)

Is there a way to know which files have changed in a docker container compared to its base image?

I am looking both for file creation/modification/deletion, but also for metadata change like file permissions.

**Tags:** docker, audit


---

## 1 answers

### Answer by username_0 on 2019-02-12. Score: 3 | Accepted answer

The docker container diff command shows the differences between a container and its base system.
In the output, files are reported as (A) if the file or directory was added, (D) if a file or directory was deleted or (C) if a file or directory was changed. File permission changes are reported as (C).
she$ CID=$(sudo docker run --rm -d ubuntu sleep 500)
sh$ sudo docker exec $CID touch newfile
sh$ sudo docker exec $CID useradd bob
sh$ sudo docker exec $CID chmod o-x /usr/bin/cut
sh$ sudo docker diff $CID
C /etc
C /etc/group
A /etc/group-
C /etc/gshadow
A /etc/gshadow-
C /etc/passwd
A /etc/passwd-
C /etc/shadow
A /etc/shadow-
C /etc/subgid
A /etc/subgid-
C /etc/subuid
A /etc/subuid-
A /newfile
C /usr
C /usr/bin
C /usr/bin/cut
C /var
C /var/log
C /var/log/faillog
C /var/log/lastlog
C /var/log/tallylog


---

