Docker cheatsheet

This cheat sheet features the most important and commonly used Docker commands for easy reference.

References
Images
Containers
Inspect
Volumes
Networks
Registry & Login
Cleanup
Dockerfile Instructions
Docker Compose
Docker Context (Remote Management)
Security Best Practices
Useful Tips

References

Images

Build an image

docker build -t <image_name>:<tag> .

Build with a specific Dockerfile

docker build -f <Dockerfile> -t <image_name>:<tag> .

Build with build arguments

docker build --build-arg <ARG_NAME>=<value> -t <image_name>:<tag> .

Build with no cache

docker build --no-cache -t <image_name>:<tag> .

Build for a specific platform

docker build --platform linux/amd64 -t <image_name>:<tag> .

Multi-platform build (requires buildx)

docker buildx build --platform linux/amd64,linux/arm64 -t <image_name>:<tag> --push .

List images

docker images

List images with filters

docker images --filter "dangling=true"
docker images --filter "reference=<image_name>:*"

Remove an image

docker rmi <image_id>

Remove all images

docker rmi $(docker images -q)

Remove all untagged images

docker rmi $(docker images | grep '^<none>' | awk '{print $3}')

Pull an image

docker pull <image_name>:<tag>

Push an image

docker push <image_name>:<tag>

Tag an image

docker tag <image_id> <image_name>:<tag>

Save an image to a tar file

docker save -o <file_name>.tar <image_name>:<tag>

Load an image from a tar file

docker load -i <file_name>.tar

View image history (layers)

docker history <image_name>:<tag>

Inspect an image

docker inspect <image_name>:<tag>

Containers

Run a container

docker run -d --name <container_name> -p <host_port>:<container_port> <image_name>:<tag>

Run a container with environment variables

docker run -d --name <container_name> -e KEY=VALUE <image_name>:<tag>

Run a container with env file

docker run -d --name <container_name> --env-file .env <image_name>:<tag>

Run a container with a volume mount

docker run -d --name <container_name> -v <host_path>:<container_path> <image_name>:<tag>

Run a container with a read-only volume

docker run -d --name <container_name> -v <host_path>:<container_path>:ro <image_name>:<tag>

Run a container with a named volume

docker run -d --name <container_name> -v <volume_name>:<container_path> <image_name>:<tag>

Run a container with a tmpfs mount

docker run -d --name <container_name> --tmpfs /tmp <image_name>:<tag>

Run a container with restart policy

docker run -d --name <container_name> --restart=always <image_name>:<tag>
# Options: no, on-failure, on-failure:5, always, unless-stopped

Run a container with resource limits

docker run -d --name <container_name> --memory=512m --cpus=1.5 <image_name>:<tag>

Run a container with a specific network

docker run -d --name <container_name> --network <network_name> <image_name>:<tag>

Run a container with a hostname

docker run -d --name <container_name> --hostname <hostname> <image_name>:<tag>

Run a container with a specific user

docker run -d --name <container_name> --user <uid>:<gid> <image_name>:<tag>

Run a container in interactive mode

docker run -it --name <container_name> <image_name>:<tag> /bin/bash

Run a container and remove it after it stops

docker run --rm <image_name>:<tag>

Run a container with health check

docker run -d --name <container_name> \
  --health-cmd="curl -f http://localhost/ || exit 1" \
  --health-interval=30s \
  --health-timeout=10s \
  --health-retries=3 \
  <image_name>:<tag>

Run a container with PID limit

docker run -d --name <container_name> --pids-limit=100 <image_name>:<tag>

List running containers

docker ps

List all containers

docker ps -a

List containers with custom format

docker ps --format "table \t\t\t"

Stop a container

docker stop <container_id>

Stop a container with timeout

docker stop -t 30 <container_id>

Stop all containers

NOTE: This will stop ALL your containers.

docker stop $(docker ps -aq)

Start a container

docker start <container_id>

Restart a container

docker restart <container_id>

Pause a container

docker pause <container_id>

Unpause a container

docker unpause <container_id>

Remove a container

docker rm <container_id>

Force remove a running container

docker rm -f <container_id>

Remove all containers

NOTE: This will remove ALL your containers.

docker rm $(docker ps -aq)

Stop and remove all containers and images

NOTE: This will remove ALL your images and containers.

docker stop $(docker ps -aq) && docker rm $(docker ps -aq) && docker rmi $(docker images -q)

Kill all running containers

docker kill $(docker ps -q)

Connect to a running container

docker exec -it <container_id> /bin/bash

Execute a command in a running container

docker exec <container_id> <command>

Execute a command as a specific user

docker exec -u <user> <container_id> <command>

View container logs

docker logs <container_id>

Follow container logs

docker logs -f <container_id>

View logs with timestamps

docker logs -t <container_id>

View last N lines of logs

docker logs --tail 100 <container_id>

View logs since a specific time

docker logs --since 2024-01-01T00:00:00 <container_id>

Copy files from container to host

docker cp <container_id>:<container_path> <host_path>

Copy files from host to container

docker cp <host_path> <container_id>:<container_path>

View container resource usage

docker stats <container_id>

View resource usage of all containers

docker stats

View container processes

docker top <container_id>

View container port mappings

docker port <container_id>

Rename a container

docker rename <old_name> <new_name>

Create an image from a container

docker commit <container_id> <image_name>:<tag>

Export a container filesystem as a tar archive

docker export <container_id> > <file_name>.tar

View container changes (diff)

docker diff <container_id>

Wait for a container to stop and get exit code

docker wait <container_id>

Inspect

Get IP address of a running container

docker inspect -f '' <container_id>

Get container environment variables

docker inspect -f '' <container_id>

Get container mount points

docker inspect -f ' -> ' <container_id>

Get container restart count

docker inspect -f '' <container_id>

Get container health status

docker inspect -f '' <container_id>

See all space Docker takes up

docker system df

See detailed space usage

docker system df -v

Inspect a container

docker inspect <container_id>

Volumes

Create a volume

docker volume create <volume_name>

Create a volume with a specific driver

docker volume create --driver <driver_name> <volume_name>

List volumes

docker volume ls

Inspect a volume

docker volume inspect <volume_name>

Remove a volume

docker volume rm <volume_name>

Remove all unused volumes

docker volume prune

Backup a volume

docker run --rm -v <volume_name>:/data -v $(pwd):/backup alpine tar czf /backup/<backup_name>.tar.gz -C /data .

Restore a volume

docker run --rm -v <volume_name>:/data -v $(pwd):/backup alpine tar xzf /backup/<backup_name>.tar.gz -C /data

Networks

Create a network

docker network create <network_name>

Create a network with a specific subnet

docker network create --subnet=172.18.0.0/16 <network_name>

Create a network with a specific driver

docker network create --driver bridge <network_name>
# Drivers: bridge, host, overlay, macvlan, none

List networks

docker network ls

Inspect a network

docker network inspect <network_name>

Connect a container to a network

docker network connect <network_name> <container_id>

Connect a container to a network with a specific IP

docker network connect --ip 172.18.0.10 <network_name> <container_id>

Disconnect a container from a network

docker network disconnect <network_name> <container_id>

Remove a network

docker network rm <network_name>

Remove all unused networks

docker network prune

docker login

docker login <registry_url>

Logout from a registry

docker logout <registry_url>

aws ecr get-login-password --region <region> | docker login --username AWS --password-stdin <account_id>.dkr.ecr.<region>.amazonaws.com

Tag and push to a private registry

docker tag <image_name>:<tag> <registry_url>/<image_name>:<tag>
docker push <registry_url>/<image_name>:<tag>

Search Docker Hub

docker search <term>

Cleanup

Remove all unused objects (containers, networks, images, cache)

docker system prune

Remove all unused objects including volumes

docker system prune --volumes

Remove all unused objects (force, no confirmation)

docker system prune -af --volumes

Remove all unused images (not just dangling)

docker image prune -a

Remove stopped containers

docker container prune

Remove build cache

docker builder prune

Remove all build cache (force)

docker builder prune -af

Dockerfile Instructions

Common Dockerfile instructions reference

# Base image
FROM <image_name>:<tag>

# Multi-stage build
FROM <image_name>:<tag> AS builder

# Set metadata
LABEL maintainer="<name>"
LABEL version="1.0"

# Set environment variables
ENV <KEY>=<VALUE>

# Set build-time variables
ARG <ARG_NAME>=<default_value>

# Set working directory
WORKDIR /app

# Copy files from host to image
COPY <src> <dest>

# Copy files with ownership
COPY --chown=<user>:<group> <src> <dest>

# Copy from a build stage
COPY --from=builder /app/build /app

# Add files (supports URLs and auto-extraction of tar files)
ADD <src> <dest>

# Run a command during build
RUN <command>

# Run multiple commands in a single layer
RUN apt-get update && \
    apt-get install -y <package> && \
    rm -rf /var/lib/apt/lists/*

# Set the default command
CMD ["executable", "param1", "param2"]

# Set the entrypoint
ENTRYPOINT ["executable"]

# Expose a port
EXPOSE <port>

# Define a volume
VOLUME ["/data"]

# Set the user
USER <user>:<group>

# Health check
HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
  CMD curl -f http://localhost/ || exit 1

# Disable health check
HEALTHCHECK NONE

# Signal to stop the container
STOPSIGNAL SIGTERM

# Set shell
SHELL ["/bin/bash", "-c"]

Multi-stage build example

# Build stage
FROM golang:1.21-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o main .

# Production stage
FROM alpine:3.19
RUN apk --no-cache add ca-certificates
WORKDIR /app
COPY --from=builder /app/main .
EXPOSE 8080
USER nobody:nobody
ENTRYPOINT ["./main"]

Java Spring Boot example

FROM eclipse-temurin:21-jre-alpine
WORKDIR /app
COPY target/*.jar app.jar
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
  CMD wget --quiet --tries=1 --spider http://localhost:8080/actuator/health || exit 1
ENTRYPOINT ["java", "-jar", "app.jar"]

Node.js example

FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
EXPOSE 3000
USER node
CMD ["node", "index.js"]

Docker Compose

Start services

docker compose up -d

Start a specific service

docker compose up -d <service_name>

Stop services

docker compose down

Stop services and remove volumes

docker compose down -v

Stop services and remove images

docker compose down --rmi all

View logs

docker compose logs -f

View logs for a specific service

docker compose logs -f <service_name>

Rebuild and start services

docker compose up -d --build

Rebuild a specific service

docker compose up -d --build <service_name>

Force recreate containers

docker compose up -d --force-recreate

Scale a service

docker compose up -d --scale <service_name>=3

List running services

docker compose ps

List all services (including stopped)

docker compose ps -a

Execute a command in a service

docker compose exec <service_name> <command>

Run a one-off command in a service

docker compose run --rm <service_name> <command>

Pull latest images

docker compose pull

View service configuration

docker compose config

Validate compose file

docker compose config --quiet

View service resource usage

docker compose top

Restart a specific service

docker compose restart <service_name>

Pause/unpause services

docker compose pause
docker compose unpause

Docker Compose file example

version: "3.9"

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        - APP_ENV=production
    image: <image_name>:<tag>
    container_name: <container_name>
    ports:
      - "8080:8080"
    environment:
      - DATABASE_URL=postgresql://<user>:<password>@db:5432/<db_name>
    env_file:
      - .env
    volumes:
      - app-data:/app/data
    networks:
      - app-network
    depends_on:
      db:
        condition: service_healthy
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 512M
        reservations:
          cpus: "0.5"
          memory: 256M
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  db:
    image: postgres:16-alpine
    container_name: db
    ports:
      - "5432:5432"
    environment:
      - POSTGRES_USER=<user>
      - POSTGRES_PASSWORD=<password>
      - POSTGRES_DB=<db_name>
    volumes:
      - db-data:/var/lib/postgresql/data
    networks:
      - app-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U <user>"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  app-data:
  db-data:

networks:
  app-network:
    driver: bridge

Docker Context (Remote Management)

List contexts

docker context ls

Create a context for a remote host

docker context create <context_name> --docker "host=ssh://<user>@<host>"

Switch context

docker context use <context_name>

Remove a context

docker context rm <context_name>

Security Best Practices

Run a container as non-root

docker run -d --user 1000:1000 <image_name>:<tag>

Run a container with read-only filesystem

docker run -d --read-only <image_name>:<tag>

Run a container with no new privileges

docker run -d --security-opt=no-new-privileges <image_name>:<tag>

Drop all capabilities and add only needed ones

docker run -d --cap-drop ALL --cap-add NET_BIND_SERVICE <image_name>:<tag>

Scan an image for vulnerabilities

docker scout cves <image_name>:<tag>

View image SBOM (Software Bill of Materials)

docker sbom <image_name>:<tag>

Useful Tips

View Docker version

docker version

View Docker system info

docker info

View Docker events in real-time

docker events

Format output as JSON

docker ps --format ''

Update container restart policy

docker update --restart=always <container_id>

Update container resource limits

docker update --memory=1g --cpus=2 <container_id>