DOCKER CHEATSHEET
Updated: 31 October 2026

Replace uppercase placeholders with your values. Linux examples use a Linux shell; they are not PowerShell commands.

CHECK THE ENGINE

# Client and server versions [View]
docker version

# Engine information [View]
docker info
# A daemon connection error means the engine is unavailable or inaccessible.

# Available contexts [View]
docker context ls

# Disk usage by Docker objects [View]
docker system df

IMAGES

# Build from the current directory [Change]
docker build -t APP:local .
# Uses the current build context and its Dockerfile. Build instructions execute during the build.

# List local images [View]
docker image ls

# Inspect image configuration [View]
docker image inspect APP:local

# Read the configured user [View]
docker image inspect APP:local --format "{{.Config.User}}"
# An empty value means the image did not specify a user; it does not establish the effective UID in every run.

RUN & INSPECT

# Run on a loopback-only port [Change]
docker run --rm --name APP -p 127.0.0.1:3000:3000 IMAGE
# Foreground run. --rm removes the container after it exits; it does not remove named volumes.

# List running containers [View]
docker ps

# Include stopped containers [View]
docker ps -a

# Follow recent logs [View]
docker logs --tail 100 --follow CONTAINER
# Streams stdout/stderr available through the logging driver. Ctrl+C stops following, not the container.

# Inspect a container [View]
docker inspect CONTAINER

# Inspect health status [View]
docker inspect CONTAINER --format "{{if .State.Health}}{{.State.Health.Status}}{{else}}no healthcheck{{end}}"

# Open a shell in a running container [Change]
docker exec -it CONTAINER sh
# Runs a process inside the container. sh may not exist in minimal images; commands you run can change container data.

COMPOSE & CLEANUP

# Check a Compose configuration [View]
docker compose config --quiet
# Validates the configuration without printing its resolved values.

# Start a Compose project [Change]
docker compose up -d
# Creates or updates the project and runs services in the background.

# See Compose services [View]
docker compose ps

# Stop one container [Change]
docker stop CONTAINER
# Sends the configured stop signal, then may force termination after the timeout. A --rm container is removed on exit.

# Remove one stopped container [Delete]
docker rm CONTAINER
# Removes the container and its writable layer. Does not remove named volumes.

# Stop and remove a Compose project [Delete]
docker compose down
# Removes project containers and networks; named volumes remain without --volumes.

RUNTIME DIAGNOSIS

# One resource-usage snapshot [View]
docker stats --no-stream CONTAINER

# Processes inside a container [View]
docker top CONTAINER

# Inspect writable-layer differences [View]
docker diff CONTAINER
# Shows added, changed, and deleted paths relative to the image.

# Logs with timestamps [View]
docker logs --timestamps --tail 100 CONTAINER

# Wait for a container to exit [View]
docker wait CONTAINER
# Blocks and prints its exit code.

# Copy one file out [Change]
docker cp CONTAINER:/PATH/FILE ./FILE
# Copies to your computer and may overwrite the destination.

# Print a container label [View]
docker inspect CONTAINER --format '{{index .Config.Labels "KEY"}}'

# Find containers with an exact label [View]
docker ps -a --filter label=KEY=VALUE

# Inspect published ports [View]
docker port CONTAINER

CONSTRAIN A NEW CONTAINER

# Run as an explicit UID and GID [Change]
docker run --rm --user 65534:65534 IMAGE COMMAND
# The command must have permission to access its required files.

# Read-only root with temporary scratch storage [Change]
docker run --rm --read-only --tmpfs /tmp:rw,noexec,nosuid,mode=1777 IMAGE
# Application writes must use writable mounts.

# Drop capabilities and block privilege escalation [Change]
docker run --rm --cap-drop ALL --security-opt no-new-privileges IMAGE
# Test application compatibility.

# Set memory, CPU, and PID limits [Change]
docker run --rm --memory 64m --cpus 0.5 --pids-limit 32 IMAGE
# Limits require engine support and do not reserve these resources.

# Disable a container’s external network [Change]
docker run --rm --network none IMAGE COMMAND
# Only its loopback interface is available.

VOLUMES AND NETWORKS

# Create a named volume [Change]
docker volume create VOLUME
# Existing names refer to existing data; choose deliberately.

# List volumes [View]
docker volume ls

# Inspect a volume [View]
docker volume inspect VOLUME

# Mount a named volume [Change]
docker run --rm --mount type=volume,source=VOLUME,target=/data IMAGE
# Application permissions must match the mount.

# Remove one unused volume [Delete]
docker volume rm VOLUME
# Permanently removes that volume’s data; do not use it for unrelated work.

# Create an internal network [Change]
docker network create --internal NETWORK
# Creates a user-defined network isolated from external connectivity.

# List networks [View]
docker network ls

# Inspect network members [View]
docker network inspect NETWORK

# Attach a running container to a network [Change]
docker network connect NETWORK CONTAINER
# Changes that container’s connectivity.

# Remove one unused network [Delete]
docker network rm NETWORK
# Connected endpoints must be detached first.

IMAGES AND COMPOSE WORKFLOWS

# Inspect image build history [View]
docker image history IMAGE

# Add another local image tag [Change]
docker image tag SOURCE_IMAGE TARGET_IMAGE
# Does not copy layers or upload anything.

# Save an image archive [Change]
docker image save -o image.tar IMAGE
# Writes an archive on your computer.

# Load an image archive [Change]
docker image load -i image.tar
# Adds the archive’s images locally; does not run them.

# List resolved Compose service names [View]
docker compose config --services

# Follow one Compose service’s logs [View]
docker compose logs --tail 100 -f SERVICE

# Run a one-off Compose task [Change]
docker compose run --rm SERVICE COMMAND
# Creates a new container and can change mounted data.

# Stop services without removing them [Change]
docker compose stop
# Use compose start to start the same containers again.