HomeResourcesGeneral resourcesCheatsheetsDocker cheatsheet

COMMANDS

Dockercheatsheet

Build an image, run a container, inspect a problem, and clean up specific resources.

Download .txt ↓

53 commands

Check the engine

Client and server versions

View
docker version

Engine information

View
docker info

A daemon connection error means the engine is unavailable or inaccessible.

Available contexts

View
docker context ls

Disk usage by Docker objects

View
docker system df

Images

Build from the current directory

Change
docker build -t APP:local .

Uses the current build context and its Dockerfile. Build instructions execute during the build.

List local images

View
docker image ls

Inspect image configuration

View
docker image inspect APP:local

Read the configured user

View
docker image inspect APP:local --format "{{.Config.User}}"

An empty value means the image did not specify a user; it does not establish the effective UID in every run.

Run & inspect

Run on a loopback-only port

Change
docker run --rm --name APP -p 127.0.0.1:3000:3000 IMAGE

Foreground run. --rm removes the container after it exits; it does not remove named volumes.

List running containers

View
docker ps

Include stopped containers

View
docker ps -a

Follow recent logs

View
docker logs --tail 100 --follow CONTAINER

Streams stdout/stderr available through the logging driver. Ctrl+C stops following, not the container.

Inspect a container

View
docker inspect CONTAINER

Inspect health status

View
docker inspect CONTAINER --format "{{if .State.Health}}{{.State.Health.Status}}{{else}}no healthcheck{{end}}"

Open a shell in a running container

Change
docker exec -it CONTAINER sh

Runs a process inside the container. sh may not exist in minimal images; commands you run can change container data.

Compose & cleanup

Check a Compose configuration

View
docker compose config --quiet

Validates the configuration without printing its resolved values.

Start a Compose project

Change
docker compose up -d

Creates or updates the project and runs services in the background.

See Compose services

View
docker compose ps

Stop one container

Change
docker stop CONTAINER

Sends the configured stop signal, then may force termination after the timeout. A --rm container is removed on exit.

Remove one stopped container

Delete
docker rm CONTAINER

Removes the container and its writable layer. Does not remove named volumes.

Stop and remove a Compose project

Delete
docker compose down

Removes project containers and networks; named volumes remain without --volumes.

Runtime diagnosis

One resource-usage snapshot

View
docker stats --no-stream CONTAINER

Processes inside a container

View
docker top CONTAINER

Inspect writable-layer differences

View
docker diff CONTAINER

Shows added, changed, and deleted paths relative to the image.

Logs with timestamps

View
docker logs --timestamps --tail 100 CONTAINER

Wait for a container to exit

View
docker wait CONTAINER

Blocks and prints its exit code.

Copy one file out

Change
docker cp CONTAINER:/PATH/FILE ./FILE

Copies to your computer and may overwrite the destination.

Print a container label

View
docker inspect CONTAINER --format '{{index .Config.Labels "KEY"}}'

Find containers with an exact label

View
docker ps -a --filter label=KEY=VALUE

Inspect published ports

View
docker port CONTAINER

Constrain a new container

Run as an explicit UID and GID

Change
docker run --rm --user 65534:65534 IMAGE COMMAND

The command must have permission to access its required files.

Read-only root with temporary scratch storage

Change
docker run --rm --read-only --tmpfs /tmp:rw,noexec,nosuid,mode=1777 IMAGE

Application writes must use writable mounts.

Drop capabilities and block privilege escalation

Change
docker run --rm --cap-drop ALL --security-opt no-new-privileges IMAGE

Test application compatibility.

Set memory, CPU, and PID limits

Change
docker run --rm --memory 64m --cpus 0.5 --pids-limit 32 IMAGE

Limits require engine support and do not reserve these resources.

Disable a container’s external network

Change
docker run --rm --network none IMAGE COMMAND

Only its loopback interface is available.

Volumes and networks

Create a named volume

Change
docker volume create VOLUME

Existing names refer to existing data; choose deliberately.

List volumes

View
docker volume ls

Inspect a volume

View
docker volume inspect VOLUME

Mount a named volume

Change
docker run --rm --mount type=volume,source=VOLUME,target=/data IMAGE

Application permissions must match the mount.

Remove one unused volume

Delete
docker volume rm VOLUME

Permanently removes that volume’s data; do not use it for unrelated work.

Create an internal network

Change
docker network create --internal NETWORK

Creates a user-defined network isolated from external connectivity.

List networks

View
docker network ls

Inspect network members

View
docker network inspect NETWORK

Attach a running container to a network

Change
docker network connect NETWORK CONTAINER

Changes that container’s connectivity.

Remove one unused network

Delete
docker network rm NETWORK

Connected endpoints must be detached first.

Images and Compose workflows

Inspect image build history

View
docker image history IMAGE

Add another local image tag

Change
docker image tag SOURCE_IMAGE TARGET_IMAGE

Does not copy layers or upload anything.

Save an image archive

Change
docker image save -o image.tar IMAGE

Writes an archive on your computer.

Load an image archive

Change
docker image load -i image.tar

Adds the archive’s images locally; does not run them.

List resolved Compose service names

View
docker compose config --services

Follow one Compose service’s logs

View
docker compose logs --tail 100 -f SERVICE

Run a one-off Compose task

Change
docker compose run --rm SERVICE COMMAND

Creates a new container and can change mounted data.

Stop services without removing them

Change
docker compose stop

Use compose start to start the same containers again.