Docker Essentials

docker run <image>                          # run in the foreground
docker run -d --name web -p 8080:80 nginx   # detached, named, port published
docker run --rm -it ubuntu:24.04 bash       # interactive shell, deleted on exit
docker run --rm -e LOG_LEVEL=debug --env-file .env <image>
docker run -d --restart unless-stopped <image>

docker ps                     # running containers
docker ps -a                  # all containers, including exited
docker stop <container>       # SIGTERM, then SIGKILL after 10 s (-t to change)
docker start <container>
docker restart <container>
docker kill <container>       # SIGKILL immediately (or -s <signal>)
docker rm <container>         # remove an exited container
docker rm -f <container>      # stop and remove
docker container prune        # remove all exited containers

docker exec -it <container> sh              # shell in a running container (bash if installed)
docker exec <container> env                 # run a single command
docker exec -u root -it <container> sh      # as a different user

docker logs <container>                     # stdout/stderr so far
docker logs -f --tail 100 <container>       # follow, starting from the last 100 lines
docker logs --since 10m -t <container>      # last 10 minutes, with timestamps

docker cp <container>:/etc/nginx/nginx.conf ./nginx.conf   # container to host
docker cp ./site <container>:/usr/share/nginx/html        # host to container

docker build -t myapp:1.4 .                         # build from ./Dockerfile
docker build -t myapp:dev -f docker/Dockerfile.dev .
docker build --target test -t myapp:test .          # stop at a named multi-stage stage
docker build --build-arg VERSION=1.4 -t myapp:1.4 .
docker build --secret id=npmrc,src=$HOME/.npmrc .   # secret available only during the build
docker build --no-cache -t myapp:1.4 .              # ignore the layer cache
docker build --pull -t myapp:1.4 .                  # re-pull base images first

# Multi-platform image, pushed directly to a registry
docker buildx build --platform linux/amd64,linux/arm64 -t ghcr.io/me/myapp:1.4 --push .

docker pull postgres:18                      # tag
docker pull nginx@sha256:<digest>            # exact, immutable content
docker images                                # list local images
docker tag myapp:1.4 ghcr.io/me/myapp:1.4    # add a registry-qualified name
docker login ghcr.io
docker push ghcr.io/me/myapp:1.4
docker rmi myapp:1.4                         # remove a tag (and the image if unreferenced)

docker image inspect <image>                 # full metadata as JSON
docker history <image>                       # layers and the instruction that created each
docker image ls --digests                    # show content digests
docker scout cves <image>                    # vulnerability scan (Docker Scout)

docker compose up -d                 # create and start everything in the background
docker compose up -d --build --wait  # rebuild images, wait until services are healthy
docker compose watch                 # sync or rebuild on file changes (develop.watch)
docker compose ps                    # service status
docker compose logs -f web           # follow one service's logs
docker compose exec db psql -U postgres
docker compose run --rm web pytest   # one-off command in a new container
docker compose up -d --scale web=3   # run several replicas (drop fixed host ports first)
docker compose config                # print the fully resolved configuration
docker compose down                  # stop and remove containers and networks
docker compose down -v               # also remove named volumes (destroys data)

docker network ls
docker network create appnet
docker run -d --name api --network appnet myapi
docker run --rm --network appnet curlimages/curl http://api:8000/health
docker network connect appnet <container>
docker network disconnect appnet <container>
docker network inspect appnet
docker network rm appnet

docker volume create pgdata
docker volume ls
docker volume inspect pgdata
docker volume rm pgdata
docker volume prune              # unused anonymous volumes
docker volume prune -a           # unused named volumes too

# Named volume (Docker-managed) vs bind mount (host path)
docker run -v pgdata:/var/lib/postgresql postgres:18
docker run -v "$PWD":/app -w /app node:24 npm test
docker run --mount type=bind,src="$PWD",dst=/app,readonly node:24 ls /app
docker run --mount type=tmpfs,dst=/tmp <image>

docker stats                            # live CPU, memory, network, I/O per container
docker top <container>                  # processes inside the container
docker inspect <container>              # full configuration and state as JSON
docker port <container>                 # published port mappings
docker diff <container>                 # files changed in the writable layer
docker events --since 30m               # daemon events: starts, dies, OOM kills

# Extract single fields with Go templates
docker inspect -f '{{.State.Status}} {{.State.ExitCode}} {{.State.OOMKilled}}' <container>
docker inspect -f '{{json .NetworkSettings.Networks}}' <container>
docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'

docker system df -v                          # detailed usage
docker container prune --filter "until=24h"  # only containers stopped over a day ago
docker image prune -a --filter "until=168h"  # unused images older than a week

# Throwaway shells and runtimes
docker run --rm -it alpine sh
docker run --rm -it -v "$PWD":/work -w /work python:3.14 python
docker run --rm -v "$PWD":/app -w /app node:24 npm run build

# Local PostgreSQL for development
docker run -d --name pg -e POSTGRES_PASSWORD=dev \
  -p 127.0.0.1:5432:5432 -v pgdata:/var/lib/postgresql postgres:18

# Network checks from inside the Docker network
docker run --rm --network appnet nicolaka/netshoot dig api
docker run --rm curlimages/curl -sI https://example.com

# Which image and command is a container running?
docker inspect -f '{{.Config.Image}} {{.Config.Cmd}}' <container>