A Gunman on a Security Watch List killed at least two People and wounded at least 11 others
France still on high alert after a wave of attacks commissioned or inspired by Islamic State militants since early 2015, the counter-terrorism prosecutor opened an investigation.
Amid fast-moving, confusing scenes it was not clear if the suspect, identified by police as Strasbourg-born Chekatt Cherif, 29, had been cornered by commandos or had slipped the dragnet.
Medics at the scene and police sources told journalists four people had been killed. But the local region was still saying two people had died.
The attack began at about 8 pm (1900 GMT) when stallholders prepared to close down and the city's restaurants filled up.
"There was confusion initially but they locked the front doors pretty soon after the gunshots," said US citizen Elizabeth Osterwisch, who was sheltering on the top floor of the Galeries Lafayette department store. "They moved us several times, eventually settling on the place with the most protection."
"From my hotel window I saw passers-by behindhand someone who was injured and onlookers panicking," he tweeted. "Soldiers and police have cordoned off the area. We're being told to stay in the hotel."
A source close to the operation said the suspect had been cornered and shots had been fired. But an hour or so later, a police source said he was still on the run.
Strasbourg lies on the west bank of the Rhine river. On the opposite side, German police tightened border controls, officials said.
Interior Minister Christophe Castaner said the gunman was known to security services, and the local prefecture said he was on an intelligence services watch list.
A Reuter's reporter was among 30 to 40 people being held in the basement of a supermarket for their own safety, waiting for police to clear the area. Lights were switched off and bottles of water handed out.
Security was tight this year for the Christmas market, popular with visitors to the city's old quarter, with its Gothic church and half-timbered houses.
Unauthorized vehicles were barred from surrounding streets during opening hours and checkpoints were set up on bridges and access points to search pedestrians' bags.
The Paris prosecutor said the motive for the attack was not known. No one immediately claimed responsibility but the US-based Site intelligence group, which monitors jihadist websites, said Islamic State supporters were celebrating.
Sources familiar with the police operation said the suspect's home had been raided earlier in the day in connection with a robbery during the summer, but he was not found there.
Jean-Claude Juncker, head of the European Commission, the EU executive, tweeted: "My thoughts are with the victims of the Strasbourg shooting, which I condemn with the utmost firmness. Strasbourg is an excellent symbol of peace and European Democracy. Values that we will always defend."
British Prime Minister Theresa May said she was "shocked and saddened". City authorities said the market and all cultural attractions would be closed on Wednesday.
European security agencies have feared for some time that Islamist militants who left Europe to fight for Islamic State in Syria and Iraq would return after the jihadist group's defeat, with the skills and motivation to carry out attacks at home.
Secular France has been grappling with how to respond to both homegrown jihadists and foreign militants following attacks in Paris, Nice, Marseille and beyond since 2015.
In 2016, a truck plowed into a Bastille Day crowd in Nice, killing more than 80 people, while in November 2015, coordinated Islamist militant attacks on the Bataclan concert hall and other sites in Paris claimed about 130 lives. There have also been attacks in Paris on a policeman on the Champs-Elysees avenue, the satirical weekly Charlie Hebdo, and a kosher store.
Almost exactly two years ago, a Tunisian Islamist rammed a hijacked truck into a Christmas market in central Berlin, killing 11 people as well as the driver.