SSH to the VPS host, then open a shell in the running container with Docker. The normal sequence is:
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
ssh user@VPS_HOST
docker ps
docker exec -it CONTAINER_NAME shUse bash only if the image contains Bash. You normally do not run an SSH server inside each application container.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The correct access model
A Docker container usually is not a second server that needs its own SSH daemon. It is a process managed by the Docker daemon on your VPS. Administration therefore happens in two hops:
- SSH to the VPS operating system with the account and key supplied by your VPS administrator.
- Use the Docker CLI on that host to start a process inside the target container.
For a running container, that second hop is docker exec. It creates a new process, commonly an interactive shell, without replacing or taking over the container’s main process. This is the standard method for inspecting files, checking environment values, running maintenance commands, and diagnosing an application.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Before you begin
- The VPS must be reachable over SSH, and your account must be allowed to log in.
- The Docker CLI must be installed on the VPS and able to communicate with its Docker daemon.
- Your host account needs permission to use the Docker socket. Membership in a Docker administration group is effectively powerful access to the host, so it should be granted deliberately.
- You need the container’s exact name or ID. An image name is not a valid target for
docker exec. - The container must be running, and the executable you plan to start must exist in the image.
If you do not administer the VPS, ask its administrator for the approved SSH account and the least-privileged Docker access they can provide. Docker daemon access can be equivalent to root-level control of the host.
Step 1: SSH to the VPS host
From your workstation, open a terminal and connect using the host name or IP address:
Recommended Free Tools
ssh user@VPS_HOSTIf the provider requires a particular private key, specify it with the normal SSH option:
ssh -i ~/.ssh/vps_key user@VPS_HOSTAfter authentication, verify that you are on the Docker host. The prompt, host name, and your account should match the VPS you intended to manage. Run:
docker versionA successful response shows client and server information. If the command is missing, Docker is not installed in your path. If it reports a socket permission error, your host account is not authorized to access the daemon; do not work around that by exposing an unauthenticated Docker TCP endpoint.
Step 2: Find the container
List containers that are currently running:
docker psThe output includes a container ID, image, command, creation time, status, published ports, and a generated or configured name. Use the value in the NAMES column for later commands.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsIf the application may have stopped, include all containers:
docker ps --allA stopped container can be inspected, logged, and started, but it cannot accept an exec process until it is running. To narrow a long list, you can use Docker’s normal filtering options, for example:
docker ps --all --filter name=webCheck the status column carefully. A container with an Exited status is not an eligible target for an interactive shell.
Step 3: Start a stopped container when appropriate
If the target is stopped and its configured startup behavior is still what you want, start it by name or ID:
Free tools Windows power users keep installed
One-click scans. No signup required.
docker start CONTAINER_NAMEThen confirm that it is running:
docker psStarting a container runs its configured entrypoint and command; it does not create a new image or reset the container’s writable layer. If it exits again immediately, do not repeatedly start it. Inspect the reason first:
Rank #2
- Fully assembled for plug-and-play operation
- Includes Raspberry Pi 5 with 8GB RAM
- 256 GB PCIe Pi NVMe SSD (Pre-loaded with Pi 64-Bit OS)
- M.2 HAT+
- CanaKit Turbine Black Case for the Pi 5
docker ps --all
docker logs CONTAINER_NAMEThe logs often reveal a missing configuration value, an unavailable dependency, a bad command, or a permission problem. A shell cannot be opened with docker exec while the container remains stopped.
Step 4: Open an interactive shell with docker exec
For most images, start a POSIX shell with:
docker exec -it CONTAINER_NAME shThe flags have distinct purposes:
-ikeeps standard input open so you can type.-tallocates a terminal, giving the shell normal line editing and screen behavior.
If the image includes Bash, you can request it explicitly:
docker exec -it CONTAINER_NAME bashMinimal production images frequently omit Bash and sometimes contain only a small sh implementation. If Bash returns an executable-not-found error, use sh or inspect the image documentation for the shell and utilities it provides. Distroless images may contain no shell at all; in that case, use a purpose-built diagnostic method, an application endpoint, or a temporary debugging image rather than installing an SSH server simply to gain access.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Once the command succeeds, the prompt belongs to the shell process created by docker exec. Commands such as pwd, ls, and application-specific maintenance tools run inside the container’s namespaces and filesystem view.
Run one command without opening a shell
You can execute a single command non-interactively by omitting -it:
docker exec CONTAINER_NAME COMMANDExamples:
docker exec web ls /app
docker exec web printenv
docker exec web sh -c 'test -f /app/config.yml && echo present'Use this form for repeatable checks, scripts, health diagnostics, and automation. Quote shell operators with sh -c when you need pipes, conditionals, expansion, or redirection; otherwise Docker passes each argument directly to the requested executable.
The command runs in the container’s current default working directory unless you select another directory with Docker’s supported working-directory option. Environment variables and user identity are those configured for the process unless you deliberately override them. Treat changes made inside the container as operational changes to that container, not as edits to the image from which future containers will be created.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteLeave the container without stopping it
Inside an exec-created shell, type:
exitThis terminates the shell process started by docker exec. It does not intentionally stop the container’s main process, so the application should continue running. Closing the SSH session after exiting the container shell then returns you to your workstation.
If you lose the network connection, the behavior of the shell and the command it is running depends on the process and terminal handling. For long-running maintenance work, use an appropriate host-side session manager and application-specific procedure rather than assuming an interactive shell is a job scheduler.
docker exec versus docker attach
These commands solve different problems. Choose based on which process you need to observe or control.
| Aspect | docker exec |
docker attach |
|---|---|---|
| Process targeted | Starts a new command, such as sh, inside the running container. |
Connects your terminal to the existing entrypoint process, normally PID 1. |
| Typical use | Inspect files, run a diagnostic, perform a controlled maintenance task, or obtain a shell. | Watch or interact with the main foreground process when its terminal is the thing you need. |
| Effect on the application | Leaving the shell ends only the extra process; the main process normally continues. | Input and signals are delivered to the main process and can affect or stop the application. |
| Terminal risks | Use ordinary shell exit behavior. The extra process is separate from PID 1. | When interactive and TTY flags were used, Docker documents Ctrl-p followed by Ctrl-q as the detach sequence. Ctrl-c can send a signal to the foreground process. |
| Output strategy | Suitable for a focused command or shell. | Not ideal for high-volume output; use docker logs CONTAINER_NAME to read application logs instead. |
For routine administration, prefer docker exec -it ... sh. Use docker attach only when you deliberately need the container’s existing terminal and understand the signal behavior.
Rank #3
- Pi5 8GB Pack: RasTech Pi 5 8GB kit includes 1 x Pi5 8GB board ,1 x 64GB Card, 2 x Card Readers,1 x Active Cooler,1 x Case for Pi5, 2 x 4K Micro HD Out Cable,1 x GaN 27W 5A USB-C Power supply,1 x Screwdriver and 1 x instructions.
- Pi5 8GB Board: The Pi5 board is equipped with a 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz and an 800MHz VideoCore VII GPU with support for OpenGL ES 3.1 and Vulkan 1.2, which delivers a significant increase in graphics performance. Dual HD Out 4Kp60 display outputs and a built-in dual 4-channel MIPI camera/display transceiver provide state-of-the-art camera support. The Pi 5 offers a 2-3 times increase in CPU performance compare to Pi4.
- Important Graphics Features: Equipped with an 800MHz VideoCore VII GPU and providing better graphics performance, suitable for multimedia applications,gaming,and graphics intensive tasks.Provides 1 UART interface,1 card slot that supports high-speed operation, 2 USB. 3 0.5 ports that support synchronous 0Gbps operation,2 USB 2.0 port ports,2 4Kp60 display outputs that support HDR.Built-in dedicated dual 4-channel 1Gbps MIPI DSI/CSI connectors,triple the total bandwidth.
- Cooling Kit for Pi 5: Compatible with Active Cooler for Raspberry Pi5, It can provide Pi 5 board with better cooling effect in using. The Case can accurately access usb-c power jack,Micro HD Out ports, usb ports, Ethernet jack, card slot, power button, 4-lane MIPI DSI/CSI connectors and so on, and it also supports installation of cooling fan.
- 64GB Card Kit and GaN 27W USB-C Power Supply: With extra 64GB card to store more files and card readers for multiple medium, keep better performance for Raspberry Pi 5, 27W USB C Power Supply is Compatible with Pi5 8GB, offers a variety of output voltage options, including 5.1V at 5A, 9.0V at 3.0A, 12.0V at 2.25A, and 15.0V at 1.8A, providing for different device requirements.
Remote Docker commands from your workstation
You do not have to open an interactive host shell every time. Docker supports an SSH endpoint for a remote daemon. Create a named context on your workstation:
docker context create --docker host=ssh://[email protected] vpsSwitch to it and run Docker commands normally:
docker context use vps
docker ps
docker exec -it CONTAINER_NAME shThe remote SSH account still needs permission to access the Docker socket on the VPS. The context changes where your local Docker CLI sends commands; it does not install Docker in the container or publish a new network port.
For a temporary setting in the current shell, use the DOCKER_HOST environment variable:
export DOCKER_HOST=ssh://[email protected]
docker psUnset it when finished if you do not want subsequent commands sent to the VPS:
unset DOCKER_HOSTSSH connection reuse can reduce repeated authentication overhead. Docker’s SSH guidance documents these client options:
Host vps.example.com
ControlMaster auto
ControlPath ~/.ssh/control-%C
ControlPersist yesPlace equivalent settings in your SSH client configuration, adjusting the host and account to your environment. Keep the Docker endpoint protected by SSH authorization; do not replace it with an unauthenticated TCP socket exposed to the internet.
Why installing SSH inside every container is usually a mistake
Running an SSH daemon in each ordinary application container duplicates account management, keys, passwords, firewall rules, logging, and security updates. It also creates another network service that must be monitored while the container’s actual purpose may be serving HTTP, processing jobs, or running a database.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Docker’s security guidance describes SSH access as typically managed by a single server on the Docker host. The CIS Docker Benchmark 1.11.0 recommends that an SSH server should not be running within the container and directs administrators toward host SSH followed by docker exec or docker attach.
There is a legitimate exception: a container can be intentionally designed to provide an SSH service, such as a product whose application protocol is SSH. In that design, publish the SSH port deliberately, restrict it with the VPS firewall and network policy, use key authentication, patch the daemon, and include its configuration in the application’s threat model. Do not add sshd merely because you need an administrative shell.
Security controls that matter
Protect Docker socket permissions
A user who can issue unrestricted Docker commands can often mount the host filesystem, create privileged containers, or otherwise obtain host-level control. Treat Docker group membership, socket access, and remote Docker contexts as sensitive administrative privileges. Use a dedicated account, strong SSH keys, MFA where the provider supports it, and narrow authorization procedures.
Keep the daemon off the public internet
Use SSH transport for remote Docker administration. Do not expose an unauthenticated Docker TCP socket on a public address. If a TCP endpoint is unavoidable in a controlled architecture, require strong mutual authentication, restrict source networks, and document the resulting risk; ordinary VPS administration does not require that exposure.
Rank #4
- [ULTIMATE RASPBERRY PI 5 CASE & MINI PC] - Unlock the full potential of your Raspberry Pi 5 with the Pironman 5-MAX — the most advanced Raspberry Pi 5 Case for power users. This high-performance Raspberry Pi 5 Cooling Case features dual NVMe M.2 slots with RAID 0/1 support, AI accelerator compatibility ( e.g. Hailo-8l M.2 AI), a PCIe Gen2 switch, a PWM tower cooler + dual RGB fans and a smart OLED display. With its dual transparent panels and optimized cable management (including full-size HDMI), it’s the ideal Raspberry Pi 5 Enclosure for building a high-speed NAS, AI edge computing device, or Home Assistant hub. (Raspberry Pi NOT Included)
- [DUAL NVMe M.2 SLITS & NAS RAID SUPPORT] - Supercharge your storage with the best Raspberry Pi 5 NVMe Case solution. Featuring two expandable NVMe M.2 slots (2230-2280) powered by a built-in PCIe Gen2 switch, this Raspberry Pi 5 NAS Case supports RAID 0/1 for ultra-fast data setups. Whether you're using a high-speed NVMe SSD or a Hailo-8L AI accelerator, Pironman 5-MAX delivers the ultimate performance boost for advanced Raspberry Pi 5 AI applications and edge computing
- [ADVANCED COOLING SYSTEM] - Engineered for high-performance builds, Pironman 5-MAX features a powerful tower cooler, one PWM fan, and dual RGB fans for enhanced airflow. The dual transparent panel design improves ventilation while showcasing vibrant RGB lighting. Ideal for cooling both the Raspberry Pi 5 and dual NVMe SSDs or AI accelerators like Hailo-8L, it ensures stable operation under heavy workloads with low noise and long-term durability
- [SMART OLED DISPLAY WITH VIBRATION WAKE-UP] - Pironman 5-MAX features a 0.96" OLED screen that delivers real-time system insights including CPU usage, memory, temperature, IP address, and disk status. With customizable display options and auto sleep mode, the screen can be instantly reactivated by a light tap thanks to the built-in vibration sensor—offering a smarter and more interactive experience
- [ENHANCED FUNCTIONALITY] - Pironman 5-MAX empowers your Raspberry Pi 5 with advanced features like safe shutdown via a metal power button, customizable RGB lighting, dual full-size HDMI ports, vibration-triggered OLED wake-up, and an external GPIO extender. It also includes RTC battery support for timekeeping and seamless Home Assistant integration. With detailed guides, online tutorials, and full technical support from SunFounder, setup and use are effortless and worry-free
Minimize changes inside running containers
Edits made interactively in a container’s writable layer may disappear when the container is replaced. Prefer changing the image, deployment configuration, or mounted persistent data through your normal release process. Use an interactive shell for diagnosis and carefully bounded emergency work, not as a substitute for configuration management.
Audit what you run
Before executing a destructive command, confirm the context, host, container name, current directory, and target data. A remote Docker context can make a command look local while operating on the VPS. Avoid pasting secrets into shell history, and limit the output of commands such as printenv when environment variables may contain credentials.
Troubleshooting common failures
“Permission denied” on the Docker socket
The SSH login succeeded, but the host account lacks Docker daemon permission. Confirm the account and socket ownership with the VPS administrator. Use an authorized administrative account or request narrowly controlled access. Do not make the socket world-writable and do not publish an unauthenticated daemon port as a workaround.
“No such container”
Run:
docker ps --allCopy the exact name or ID from the output. Check spelling, punctuation, and whether your Docker context points to the expected VPS. Remember that docker exec accepts a container identifier, not an image name, service label, or host port.
“Executable file not found” for Bash
The image does not contain bash at the requested path. Try:
docker exec -it CONTAINER_NAME shIf sh is also absent, the image may be intentionally minimal. Use the image’s documented diagnostic command, inspect logs and health status from the host, or deploy a supported debug variant. Installing packages interactively may be impossible and will not persist into a replacement container.
The container exits immediately
Inspect its state and logs:
docker ps --all
docker logs CONTAINER_NAMEBecause docker exec requires a running container, fix the startup problem or use a purpose-built temporary container for offline inspection. Do not confuse a container’s stopped state with a failed SSH connection.
You need the main process’s terminal
Use docker attach CONTAINER_NAME only when connecting to PID 1 is intentional. Understand that keystrokes and signals can reach the application. For ordinary output, prefer:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsdocker logs CONTAINER_NAMEDetach with Docker’s documented key sequence when the container was started with interactive and TTY flags, rather than sending an accidental interrupt to the foreground process.
Commands affect the wrong VPS
If you use contexts or DOCKER_HOST, verify the active destination before running a change:
docker context show
docker context lsSwitch back to the local daemon when appropriate:
docker context use default
unset DOCKER_HOSTThen repeat docker ps and verify the host and container identity.
A repeatable administration checklist
- Confirm the VPS host name, account, and approved SSH key.
- Connect with
ssh user@VPS_HOST. - Verify Docker access and the destination with
docker context showor the host prompt. - List running containers using
docker ps; usedocker ps --allif the target may be stopped. - Check the exact container name or ID.
- Start it with
docker start CONTAINER_NAMEonly when restarting the configured application is appropriate. - Open a separate shell with
docker exec -it CONTAINER_NAME sh, or run one bounded command without-it. - Use
docker logsfor application output anddocker attachonly for deliberate PID 1 interaction. - Exit the shell with
exit, then close the host SSH session. - Record configuration changes in the image or deployment system so they survive replacement.
Which method should you choose?
| Your goal | Recommended method | Reason |
|---|---|---|
| Open a maintenance shell in an ordinary running container | docker exec -it NAME sh |
Starts an isolated shell without taking over the application process. |
| Run one diagnostic or scripted check | docker exec NAME COMMAND |
Produces a repeatable result without an interactive session. |
| Read application output | docker logs NAME |
Avoids attaching a terminal to a high-volume foreground process. |
| Interact with the container’s existing foreground process | docker attach NAME |
Targets PID 1, but carries signal and lifecycle risk. |
| Operate a VPS daemon from a workstation | Docker SSH context or DOCKER_HOST=ssh://... |
Uses SSH transport without publishing an unauthenticated Docker socket. |
| Provide SSH as the application’s actual protocol | A deliberately published, hardened SSH service | Appropriate only when SSH is part of the application design. |
The practical default remains host SSH followed by docker ps and docker exec -it CONTAINER_NAME sh. It matches Docker’s process model, avoids unnecessary daemons in application images, and makes the boundary between host administration and container inspection explicit.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
