Enable downloading files from a running container

[philliphoff]

An earlier feature enabled viewing (read-only) files in a running container. This issue builds on that functionality to allow the user to download files from the running container to the local machine (rather than opening them in an editor). This can be useful for non-text files, or just eliminating the need to cut & paste from the editor.

[PavelSosin-320]

About which docker files you are talking about here?
Everything under Docker daemon filesystem root should be restricted from access bypassing Docker's engine interface. Nothing can be directly "opened". When user/IT configures Docker engine port as 2376 it means that everything, everything, everything must be transferred with TLS encoding including logs. If Docker is installed correctly on the Linux machine access to the Docker files is restricted from outside of the Host.
The only file which can be readable by the user is the Docker daemon log, but only by the root user because Docker daemon runs as root.
The only allowed method to transfer or view files from Docker filesystem is docker cp command and docker logs. docker logs transfer logs content encoded like any data.
The bind volumes change from outside docker will result in fatal docker diff corruption. Then the docker export will produce junk.
The Docker daemon log is only a human-readable file and contains very technical information about Host OS, Drivers configuration, and Docker startup.

[PavelSosin-320]

FYI! Container root FS vs Volumes
The existence of NTFS storage driver means that data can be copied from the 3rd machine where data are actually stored.

[philliphoff]

@PavelSosin-320 This feature, at its core, it just automating what the end user would do themselves to view/extract an arbitrary file from a running container. There's no bypassing of the Docker host; if the user has the ability to docker cp the file from the container or attach a terminal to the container (to list the file), then tooling can do the same. (That's quite literally what the tooling does, the latter in the case of Windows which doesn't support docker cp.)