HOWTO · Docker
How to Copy Files From Docker Container to Host
This tutorial demonstrates how to copy files from docker container to the host.
On this page
The quickest way to get files from a Docker container onto the host is the docker cp command, which copies files and directories in either direction and works on running or stopped containers. A common reason for doing this is sharing log files or generated output with team members. Two constraints are worth knowing up front: docker cp cannot copy pseudo-filesystem mounts such as /proc, /sys, /dev, or tmpfs inside the container, and whether you can read sensitive paths depends on the container’s user and mount configuration rather than a blanket ban.
The commands below run in the host shell unless noted otherwise. They assume Docker is installed and a container exists, and they behave the same on Linux and in WSL environments.
Copy files from a container with docker cp
docker cp takes a source and a destination, and whichever argument names the container decides the direction:
- Container to host:
docker cp CONTAINER:SRC_PATH DEST_PATH - Host to container:
docker cp SRC_PATH CONTAINER:DEST_PATH
CONTAINER is the container’s name or id, which you can find with docker ps -a. SRC_PATH is a path inside the container, absolute or relative to the container’s root /, and DEST_PATH is an ordinary path on the host. Passing - as the destination streams the content to stdout as a tar archive, which is handy for piping into tar -x. Like cp -a, docker cp copies directories recursively and preserves file permissions where the host allows it.
A typical container-to-host sequence looks like this:
docker run -d --name demo ubuntu sleep 3600— start a container that stays up while you work.docker exec demo touch /usr/share/new_file.txt— create a file inside the container.docker cp demo:/usr/share/new_file.txt ./new_file.txt— copy it into the current host directory.docker cp demo:/usr/share ./share-copy— the same form copies a whole directory recursively.
These are native Docker operations, so they are shown as inline commands rather than an executed example; run them on a machine with a Docker engine. Note that you can also use docker cp against a stopped container, so the target does not need to be running.
Share files with a bind mount
When you need continuous two-way access instead of a one-off copy, a bind mount maps a host directory directly into the container’s filesystem. Files the container writes to the mounted path appear in the host directory immediately, and files you place in the host directory are visible inside the container, so there is no separate copy step at all.
Create the mount when the container starts, using either the short -v host_dir:container_dir form or the more explicit docker run --mount type=bind,source=<host_dir>,target=<container_dir> .... Append :ro or ,readonly to give the container read-only access. For example, docker run -it --name shared -v "$HOME/shared":/shared ubuntu bash gives the container a /shared directory backed by ~/shared on the host, and you can create several mounts on one container or share one host directory across several containers.
Because a bind mount is fixed at container creation, it suits new or recreated containers; for an existing container you cannot modify, docker cp remains the right tool for a quick extraction.
Understand what Dockerfile COPY does
COPY is a Dockerfile instruction that runs at image-build time: COPY <src> <dest> copies files from the build context — the directory you pass to docker build — into the image’s filesystem. It cannot reach files outside the build context, and it does not pull files out of an existing or running container; for that task use docker cp or a bind mount as described above.
This example writes a minimal Dockerfile to a temporary directory and prints it; actually building the image requires a Docker engine and the referenced context files:
workdir=$(mktemp -d)
cat > "$workdir/Dockerfile" <<'EOF'
FROM python:3-slim
WORKDIR /var/www
COPY ./app.py /var/www/app.py
COPY ./requirements.txt /var/www/requirements.txt
RUN pip install -r /var/www/requirements.txt
ENTRYPOINT ["python", "/var/www/app.py"]
EOF
cat "$workdir/Dockerfile"
FROM python:3-slim
WORKDIR /var/www
COPY ./app.py /var/www/app.py
COPY ./requirements.txt /var/www/requirements.txt
RUN pip install -r /var/www/requirements.txt
ENTRYPOINT ["python", "/var/www/app.py"]
Verify the copied files
After docker cp, confirm the transfer on the host: list the destination with ls -l, inspect the content with cat or head, and for an integrity check compare sha256sum output on both sides, for example docker exec CONTAINER sha256sum /path/in/container where the image provides that tool. With a bind mount, listing the host directory is itself the check, because both sides share the same files.
Run this example to practice the host-side checks on a stand-in file:
dest=$(mktemp -d)
printf 'log line 1\nlog line 2\n' > "$dest/access.log"
ls "$dest"
cat "$dest/access.log"
wc -l < "$dest/access.log"
access.log
log line 1
log line 2
2
If the expected file is missing, docker cp exits with an error that names the path it could not resolve; recheck the container name or id and the source path inside the container before retrying.
