How do a prevent a user of my pre-built docker container from being able to access a shell within a running instance of that container? I have googled and read all the posts that are related to this scenario and have come up without a working solution. I am trying to prevent access to a given resource in the container, for the sake of this inquiry, let's say its a serial number in a configuration file. I am building upon the java:7 image which is based upon an ubuntu image.

To test your solution, do the following:

  1. Create and run your docker container

  2. Export your container

    docker export [container name] | gzip -c > mycontainer.tar.gz

  3. Import your container on an external system

    gzip -dc mycontainer.tar.gz | docker import - [container name]

  4. Run the container

  5. Shell into the running container using any / all of the following methods:

    docker exec -it [container name] bash

    docker attach [container name]

    docker run -ti --entrypoint=/bin/bash [container name]

[container name] is the name of your container

bash, dash, and sh are all valid shells

  • 1
    If you're trying to protect information inside of your container, docker is not the technology you want. Even if you were able to restrict shell access, there are a myriad of other trivial means to get access to the filesystem inside the container.
    – EEAA
    Sep 24, 2015 at 13:59
  • Unfortunately I have to use docker in this instance; I am well aware that it is not ideal in this case. Sep 24, 2015 at 14:02
  • 1
    Hey @EEAA could you point me to a list of those "trivial means" ? What would you suggest instead of docker then ? Jul 7, 2019 at 21:44
  • serverfault.com/questions/1051005/… has some tips for actually enforcing this though the question is specific to containerizing a Python script. The general idea should easily transfer to other programming languages, and be a lot easier to pull off if the language can be compiled to a native statically linked binary.
    – tripleee
    Apr 8, 2021 at 5:28

3 Answers 3


To add on to Jose's answer, another solution is to...

docker exec :id -it /bin/rm -R /bin/*

That gets rid of sh and any bin useful command in linux. I'm unsure what you'd do to get into the container at that point. Though I know that you might be able to use a memory debugger to get environment variables of the running container, but it makes it that much more annoying... I wonder if theres a way to lock down that memory in ring 0 and take away ssh access altogether to the host.

If anyone knows how to crack that, I would be interested in knowing how.


You want to use docker secrets if you're protecting sensitive information. Check out:


  • This works perfectly for my purposes, thanks! Although I believe the correct command is: docker exec -it 'container-id' /bin/rm -R /bin/*
    – ty01
    Mar 11, 2019 at 18:30
  • This does not work for me on Docker version 18.09.6, build 481bc77156 . The approach by @ty01 gives this error message /bin/rm: cannot remove '/bin/<filename>': No such file or directory for all filenames in /bin. The answer by @Dr. Knowitall returns Error: No such container: :id. Even if I replace id by the CONTAINER_ID from docker ps, it still gives the same error message.
    – edesz
    May 14, 2019 at 19:03
  • To bypass the binary removal method, you can copy what binary you need to interact with the container using docker cp. Let's say you have a static build of bash and rm and other binaries. Just docker cp /path/to/your/binaries <containerId>:/bin/. Then, you restored access to the docker with docker exec ... bash again.
    – Chong
    May 12, 2021 at 9:59

For the bash command specifically, I added in the .bashrc file the command exit at the end of the file, so the user logs in and finally kicked out, but users still can use sh command.

  • 1
    You can also trivially bypass this with bash --norc
    – tripleee
    Apr 8, 2021 at 5:25

If the information that you want to protect is a serial number, then encrypting that information is the only sure ways to protect it. You can choose various ways to encrypt secret data, make sure you are using a strong key. You can also make your application send secret data to your server to identify their validity and based on the replies from your server the apps can continue working or stop and show messages.

In a short way, always assume that your application can be dissected completely and thoroughly. Always encrypt all secret and important data using strong key so cracking the key will take very long time (assume that the encryption algorithm is publicly available or well known).

Preventing access alone even if you find a way to do it will just give a false sense of security.

  • 3
    ...then the secret to protect becomes the encryption key, and you need to protect it with an encryption key. And protect that key with a key and protect that key with a key and...
    – Mark
    Sep 12, 2019 at 16:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .