What is the exact difference between --attach STDIN and --interactive?

Question

The docker run documentation claims:

If you do not specify -a then Docker will attach to both stdout and stderr . You can specify to which of the three standard streams (STDIN, STDOUT, STDERR) you’d like to connect instead, as in:

$ docker run -a stdin -a stdout -i -t ubuntu /bin/bash

For interactive processes (like a shell), you must use -i -t together in order to allocate a tty for the container process. -i -t is often written -it as you’ll see in later examples. Specifying -t is forbidden when the client is receiving its standard input from a pipe, as in:

$ echo test | docker run -i busybox cat

So, what is the exact difference between

$ docker run -a stdin -a stdout -a stderr mcr.microsoft.com/windows/nanoserver

and

$ docker run -i mcr.microsoft.com/windows/nanoserver

Answer 1

Looking at the source you find that --interactive is mostly equivalent to --attach stdin:

    var (
        attachStdin  = copts.attach.Get("stdin")
        attachStdout = copts.attach.Get("stdout")
        attachStderr = copts.attach.Get("stderr")
    )

    //...

    if copts.stdin {
        attachStdin = true
    }

(Where copts.attach maps to the --attach flag and copts.stdin to --interactive)

And since stdout and stderr are attached by default your two command are equivalent

...mostly: using the --interactive flag stdin will also be actually attached to the stdin of the docker run client command and disconnected when the client closes stdin:

    config := &container.Config{
        //...
        OpenStdin:       copts.stdin,
        AttachStdin:     attachStdin,
        //...
    }

    //...

    // When allocating stdin in attached mode, close stdin at client disconnect
    if config.OpenStdin && config.AttachStdin {
        config.StdinOnce = true
    }

(I'm actually not quite sure what would be the use case for -a stdin since you can not actually attach to it to provide input...)