Export a Docker Container Filesystem to a Checked Tar Archive

You will finish with a tar archive of a Docker container's filesystem, a quick integrity check, and a clear boundary around data that the command does not include. The examples use Docker 29.8.1 from docker-ce-cli version 5:29.8.1-1~ubuntu.24.04~noble.

Allow about ten minutes for one small container, plus time for the archive to finish writing. You need a readable Docker CLI, access to the Docker daemon, enough free space for the archive, and a container you are allowed to inspect. The commands that read Docker state are normally unprivileged for a user in the Docker group. If your installation requires it, prefix only the Docker command with sudo; do not make the output file root-owned by accident.

1. Check the installed command

Start with the local command help. This is read-only and confirms the syntax available on this host:

$ docker version --format '{{.Client.Version}}'
29.8.1
$ docker container export --help
Usage:  docker container export [OPTIONS] CONTAINER

Export a container's filesystem as a tar archive

Aliases:
  docker container export, docker export

Options:
  -o, --output string   Write to a file, instead of STDOUT

The command has one useful option: -o or --output. Without it, the tar stream goes to standard output. The shorter docker export spelling is an alias, but using docker container export makes the operation easier to recognise in a script.

2. Choose the exact container

List container names and IDs before exporting. This avoids exporting a similarly named container or an old replacement:

$ docker ps -a --format 'table {{.ID}}\t{{.Names}}\t{{.Status}}'
CONTAINER ID   NAMES             STATUS
8f31c1d2a4b6   reports-worker    Up 2 hours
1ca7b4e9d012   reports-old       Exited (0) 3 days ago

Use the full name or a container ID copied from this output. The command accepts a full or shortened ID, but the full name or full ID leaves less room for a mistaken match:

$ CONTAINER='reports-worker'
$ docker inspect --format '{{.Id}} {{.Name}}' "$CONTAINER"
8f31c1d2a4b6... /reports-worker

The exact ID and name will differ on your host. An inspect error means the value is wrong, the container was removed, or your account cannot reach the daemon. Check that before trying other names or elevated privileges.

3. Export to a new archive

Choose a destination that does not already contain a valuable backup. Shell redirection and --output both create or replace the destination, so overwriting an existing archive is an irreversible mistake unless you have another copy.

$ ARCHIVE="$PWD/${CONTAINER}-$(date +%Y%m%d).tar"
$ test ! -e "$ARCHIVE" || { echo "refusing to overwrite: $ARCHIVE"; exit 1; }
$ docker container export --output "$ARCHIVE" "$CONTAINER"
$ printf 'archive: %s\n' "$ARCHIVE"
archive: /path/to/reports-worker-20260923.tar

The output option keeps Docker's binary tar stream out of your terminal. It does not pause a running container or produce an application-consistent database backup. If the container is actively writing files, the exported view may reflect changes made during the operation. For a database or other stateful service, use that application's backup procedure and treat this archive as a filesystem snapshot of the container, not a substitute for it.

There is no Docker undo operation for an archive already written. Recovery is simple if the export fails: keep the original container, remove only the incomplete destination after checking its path, and rerun to a different new filename. Do not delete the source container as part of this workflow.

4. Verify the archive before relying on it

First check that the file exists and is non-empty:

$ ls -lh -- "$ARCHIVE"
-rw-r--r-- 1 you you 321M Sep 23 12:10 /path/to/reports-worker-20260923.tar
$ test -s "$ARCHIVE" && echo 'archive is non-empty'
archive is non-empty

Inspect its member names without extracting anything. This is safer than unpacking an untrusted archive into your current directory:

$ tar -tf "$ARCHIVE" | sed -n '1,12p'
bin/
bin/sh
etc/
etc/hostname
usr/
usr/bin/
var/
var/log/
$ tar -tf "$ARCHIVE" | wc -l
18427

The names and count are examples, not fixed output. The useful result is that tar can read the whole listing without reporting a truncated archive. For a stronger transfer check, record a checksum and store it separately:

$ sha256sum -- "$ARCHIVE" | tee "$ARCHIVE.sha256"
6b3f...  /path/to/reports-worker-20260923.tar
$ sha256sum --check "$ARCHIVE.sha256"
/path/to/reports-worker-20260923.tar: OK

Keep the checksum beside the archive only for convenience. A copy stored on the same disk does not protect against that disk failing; copy both files to your approved backup location.

5. Account for volumes and restore expectations

A container export contains the container filesystem, not the contents of volumes mounted over directories in that filesystem. The underlying directory is exported instead. Check mounts before calling the archive a complete data backup:

$ docker inspect --format '{{range .Mounts}}{{.Type}} {{.Source}} -> {{.Destination}}{{"\n"}}{{end}}' "$CONTAINER"
volume /var/lib/docker/volumes/reports-data/_data -> /var/lib/reports

Any listed volume needs its own backup plan. Follow the volume's application and Docker documentation for that process. Do not assume that extracting the tar archive will recreate volumes, ports, environment variables, restart policy, image layers or the original container configuration. Those are separate from the exported filesystem.

If you need to inspect the archive elsewhere, extract it into a new, empty directory that is not a system path:

$ DEST="$PWD/${CONTAINER}-root"
$ test ! -e "$DEST" || { echo "refusing to reuse: $DEST"; exit 1; }
$ mkdir "$DEST"
$ tar -xf "$ARCHIVE" -C "$DEST"
$ test -e "$DEST/etc/hostname" && echo 'extraction check passed'
extraction check passed

Review archive ownership and paths before extracting an archive from someone else. Do not extract it over /, a home directory, or a live service tree. When the inspection is finished, remove only the explicitly named temporary directory if it is no longer needed.