docker-cp

Copy a file or directory from the host to a container

$ docker cp [path/to/file_or_directory_on_host] [container_name]:[path/to/file_or_directory_in_container]

$ docker cp [container_name]:[path/to/file_or_directory_in_container] [path/to/file_or_directory_on_host]

$ docker cp [[-L|--follow-link]] [path/to/symlink_on_host] [container_name]:[path/to/file_or_directory_in_container]

docker cp [OPTIONS] CONTAINER:SRC_PATH DEST_PATH|-
docker cp [OPTIONS] SRC_PATH|- CONTAINER:DEST_PATH

Arguments:
CONTAINER: The name or ID of the container.
SRC_PATH: The source path on the host or inside the container.
DEST_PATH: The destination path on the host or inside the container.
- (hyphen): Represents standard input or standard output for streaming operations.

--archive, -a
    Preserve UID:GID and permissions. Behaves like tar -p.

--follow-link, -L
    Always follow symbolic link in SRC_PATH.

--help
    Print usage statement.

docker cp is a fundamental command in the Docker CLI that facilitates the transfer of files and directories between a host machine and a running Docker container, or vice versa. It provides a convenient way to get data out of a container (e.g., logs, configuration files, output data) or to put data into a container (e.g., application code, static assets, scripts) without needing to mount volumes or use more complex methods like docker exec with tar. The command supports specifying paths on both the host and within the container. When copying from the host to the container, if the destination path does not exist, docker cp creates it. If the destination is a directory, the source is copied inside it. When copying from the container, it preserves file attributes and ownership to some extent, though this can be controlled with options. It's an essential tool for debugging, development, and managing containerized applications.

docker cp operates directly on the container's filesystem layer, bypassing any mounted volumes. This means if you copy a file to a path that is also a volume mount point, the file will be written to the container's writeable layer and not to the underlying volume itself. Permissions and ownership of copied files can sometimes be tricky: by default, it attempts to preserve them, but the destination user/group IDs might not match the source. When copying to a container, files are owned by root:root if no specific user is defined in the container's image or run configuration. Using wildcards in paths (e.g., *.txt) on the host side requires shell expansion; docker cp does not interpret them directly. For robust and complex file transfers, especially with large amounts of data, using docker exec with tar and piping (e.g., tar -c . | docker exec -i mycontainer tar -x -C /dest) is often more reliable and efficient.

When copying files from the host to a container, docker cp by default sets the ownership to root:root inside the container, unless the container is running as a different user or the --archive option is used. With --archive (or -a), docker cp attempts to preserve the original ownership (UID and GID) and permissions. However, if the UID/GID does not exist within the container, the files might appear with numeric IDs.

The hyphen (-) can be used as a special path to represent standard input or standard output. For example, to copy a file from a container and pipe it to another command on the host: docker cp mycontainer:/app/logs.txt - | less. To pipe content from standard input on the host into a file in the container: cat myconfig.txt | docker cp - mycontainer:/app/config.txt. This allows for flexible and efficient data transfer without intermediate files.

When copying a directory, docker cp copies the directory's contents. If the source is a directory /path/to/dir and the destination is /new/dest, it behaves like cp -a /path/to/dir/. /new/dest, meaning the contents of dir are copied into /new/dest. If you want to copy the directory itself (i.e., /new/dest/dir will be created), you need to specify the source with a trailing slash or the parent directory.

The docker cp command has been a core feature of the Docker CLI since its early days, reflecting the fundamental need to interact with container filesystems for development, debugging, and data extraction. Its inclusion underscores Docker's commitment to providing intuitive tools for container management. Over time, its functionality has remained largely consistent, with minor improvements focusing on handling permissions, symlinks, and providing the --archive option for more faithful file attribute preservation. It has become an indispensable command for anyone working with Docker containers.

docker exec(1), docker inspect(1), tar(1), rsync(1)