Docker Cheatsheet
Every docker and docker compose command we actually use across 41+ production containers. Searchable. Bookmark it.
Container lifecycle
docker run -d --name web -p 80:80 nginx | Run nginx detached, map host:container port |
docker run --rm -it ubuntu bash | Interactive shell, auto-remove on exit |
docker ps -a | List all containers (running + stopped) |
docker stop $(docker ps -q) | Stop all running containers |
docker rm $(docker ps -aq) | Remove all containers |
docker exec -it <container> bash | Shell into a running container |
docker logs -f --tail 100 <container> | Stream last 100 lines of logs |
Images
docker images | List local images |
docker pull alpine:3.19 | Pull specific image tag |
docker build -t myapp:v1 . | Build image from Dockerfile in cwd |
docker tag myapp:v1 registry.example.com/myapp:v1 | Tag for remote registry |
docker push registry.example.com/myapp:v1 | Push tagged image |
docker rmi $(docker images -q --filter "dangling=true") | Clean up dangling images |
docker system prune -af --volumes | Nuclear: remove ALL unused images, networks, volumes |
Networking
docker network ls | List networks |
docker network create --driver bridge mynet | Create a user-defined bridge network |
docker network inspect bridge | See which containers are on the default bridge |
docker run --network mynet --name app1 alpine sleep infinity | Run container attached to a network |
docker run -p 8080:80 nginx | Publish host:8080 → container:80 |
Volumes
docker volume ls | List named volumes |
docker volume create app-data | Create named volume |
docker run -v app-data:/data alpine sh -c "echo hi > /data/f" | Mount named volume |
docker run -v $(pwd):/workspace alpine ls /workspace | Bind mount host cwd |
docker volume prune | Remove unused volumes |
Inspection & debugging
docker inspect <container> | Full config + state JSON |
docker stats | Live CPU / memory / IO per container |
docker top <container> | Processes inside the container |
docker diff <container> | Files changed vs image |
docker cp <container>:/etc/hosts ./hosts | Copy file out of container |
Docker Compose
docker compose up -d | Start services defined in compose.yml, detached |
docker compose logs -f web | Follow logs for one service |
docker compose ps | Status of compose services |
docker compose exec db psql -U app | Run psql in the db service |
docker compose restart web | Restart one service without teardown |
docker compose down -v | Stop + remove containers AND volumes |
docker compose up -d --build --force-recreate web | Rebuild + recreate one service |
Production hardening
docker run --restart unless-stopped ... | Prod: always restart except after manual stop |
docker run --memory=512m --cpus="1.0" ... | Enforce resource limits |
docker run --read-only --tmpfs /tmp ... | Read-only rootfs + writable tmpfs (security) |
docker run --security-opt=no-new-privileges ... | Prevent privilege escalation |
docker run --user 1000:1000 ... | Run as non-root |
We manage 80+ production Docker containers for clients. See what we can do for your stack →