Docker: Monitor disk writes to the container, i.e. by the overlay storage driver

Actually the docker storage driver itself provides the answer already.

Taking the overlay2 storage driver, which is the default driver on most distributions, as an example, we see that the container layer, where all data written to the container is stored, is kept in a separate folder:

Source: How the overlay driver works

Total amount of data written to the container layer

For a complete overview of what has been written to the container, we only have to take a look at the upperdir, which is called diff on the backing (host) file system.The path of the diff folder can be found with

docker container inspect <container_name> --format='{{.GraphDriver.Data.UpperDir}}'   # ordocker container inspect <container_name> | grep UpperDir

With default settings, this path points to /var/lib/docker/overlay2/. Note that access to the "inner workings" of docker requires root access on the host, and it's a good idea not to do any writes to these folders.

Now that we have the folder on the backing file system, we can simply du in much detail as we want. As a test example, I've used an alpine image that runs a script, which writes a 10 MB dummy file every 10 seconds.

root@testbox:/var/lib/docker/overlay2/83a825d...# du -h -d 18.0K    ./work216M    ./diff216M    .root@testbox:/var/lib/docker/overlay2/83a825d...# ll diff/tmptotal 220164drwxrwxrwt 2 root root    4096 Okt 21 22:57 ./drwxr-xr-x 3 root root    4096 Okt 21 22:53 ../-rw-r--r-- 1 root root 9266613 Okt 21 22:53 dummy0.tar.gz-rw-r--r-- 1 root root 9266613 Okt 21 22:55 dummy10.tar.gz-rw-r--r-- 1 root root 9266613 Okt 21 22:55 dummy11.tar.gz[...]

Hence, seeing all the files and folders written to the container is as easy as with any other directory.