Docker Command Cheat Sheet

Nine groups from images to Compose, each with a ready-to-use example

92 commands

docker imagesImages

List local images with their sizes.

docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}"

docker pull nginx:alpineImages

Pull an image; omitting the tag means latest.

docker pull nginx:1.27-alpine

docker build -t app:1.0 .Images

Build an image from the Dockerfile in the current directory.

docker build -t registry.example.com/app:1.0 .

docker build --no-cache -t app:1.0 .Images

Rebuild without cache, useful when a stale layer causes odd behavior.

docker build --no-cache -t app:1.0 .

docker build -f Dockerfile.prod .Images

Use a Dockerfile with a non-default name.

docker build -f docker/Dockerfile.prod -t app:prod .

docker build --target builder -t app:debug .Images

Build only up to a stage; handy for multi-stage debugging.

docker build --target builder -t app:debug .

docker buildx build --platform linux/amd64,linux/arm64 -t app:1.0 .Images

Build a multi-architecture image in one go.

docker buildx build --platform linux/amd64,linux/arm64 --push -t app:1.0 .

docker tag app:1.0 registry.example.com/app:1.0Images

Tag an image with the registry path before pushing.

docker tag app:1.0 registry.example.com/team/app:1.0

docker rmi <image>Images

Remove an image; delete dependent containers first.

docker rmi app:1.0

docker history <image>Images

Show image layers and their sizes.

docker history --no-trunc app:1.0

docker save -o app.tar app:1.0Images

Export an image to a tar file for offline transfer.

docker save -o app.tar app:1.0

docker load -i app.tarImages

Load an image from a tar file.

docker load -i app.tar

docker inspect <image>Images

Inspect image metadata: env, entrypoint, exposed ports.

docker inspect --format "{{.Config.Env}}" nginx

docker run -d --name web -p 8080:80 nginxContainer lifecycle

Run in the background with a port mapping.

docker run -d --name web -p 8080:80 nginx:alpine

docker run -it --rm alpine shContainer lifecycle

Run a throwaway interactive container that removes itself on exit.

docker run -it --rm alpine sh

docker run -v pgdata:/var/lib/postgresql/data postgresContainer lifecycle

Mount a named volume so data survives container removal.

docker run -d --name pg -v pgdata:/var/lib/postgresql/data postgres:16

docker run -e TZ=Asia/Shanghai -e ENV=prod app:1.0Container lifecycle

Pass environment variables; wrong timezone usually starts here.

docker run -d -e TZ=Asia/Shanghai -e SPRING_PROFILES_ACTIVE=prod app:1.0

docker run --network host nginxContainer lifecycle

Share the host network namespace instead of mapping ports.

docker run -d --network host nginx

docker run --restart unless-stopped -d app:1.0Container lifecycle

Set a restart policy so the container comes back after a reboot.

docker run -d --restart unless-stopped app:1.0

docker run --memory 512m --cpus 1.5 app:1.0Container lifecycle

Cap memory and CPU so one container cannot starve the host.

docker run -d --memory 512m --cpus 1.5 app:1.0

docker psContainer lifecycle

List running containers only.

docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"

docker ps -aContainer lifecycle

List all containers including stopped ones.

docker ps -a --filter "status=exited"

docker start <ct>Container lifecycle

Start an existing container with its original config.

docker start web

docker stop <ct>Container lifecycle

Stop gracefully: SIGTERM first, SIGKILL after the timeout.

docker stop -t 30 web

docker restart <ct>Container lifecycle

Restart a container, often needed after config changes.

docker restart web

docker rm <ct>Container lifecycle

Remove a stopped container.

docker rm web-old

docker rm -f <ct>Container lifecycle

Force-remove a running container.

docker rm -f web

docker rename <old> <new>Container lifecycle

Rename a container.

docker rename web web-01

docker update --memory 1g <ct>Container lifecycle

Adjust resource limits without recreating the container.

docker update --memory 1g --memory-swap 1g web

docker attach <ct>Container lifecycle

Attach to PID 1; Ctrl+C also kills the container, prefer exec.

docker attach web

docker exec -it web shExec and file transfer

Get a shell inside a running container; use sh when bash is absent.

docker exec -it web /bin/sh

docker exec -u root -it web shExec and file transfer

Enter as root when the default user lacks permissions.

docker exec -u 0 -it web sh

docker exec web ls -l /etc/nginxExec and file transfer

Run a single command inside the container.

docker exec web nginx -t

docker exec web cat /etc/resolv.confExec and file transfer

Container DNS config; check it first when resolution fails.

docker exec web cat /etc/resolv.conf

docker cp ./app.conf web:/etc/nginx/conf.d/Exec and file transfer

Copy a file from the host into a container.

docker cp ./app.conf web:/etc/nginx/conf.d/app.conf

docker cp web:/var/log/app.log ./Exec and file transfer

Copy a file out of a container.

docker cp web:/var/log/app.log ./app.log

docker diff <ct>Exec and file transfer

List files changed inside the container versus the image.

docker diff web

docker export <ct> -o rootfs.tarExec and file transfer

Export the container filesystem without image metadata.

docker export web -o web-rootfs.tar

docker network lsNetworking

List all Docker networks.

docker network ls

docker network create app-netNetworking

Create a user-defined bridge network.

docker network create --driver bridge app-net

docker network inspect app-netNetworking

Show container IPs in a network; first stop for connectivity issues.

docker network inspect --format "{{range .Containers}}{{.Name}} {{.IPv4Address}}{{end}}" app-net

docker network connect app-net <ct>Networking

Attach a running container to a network.

docker network connect app-net web

docker network disconnect app-net <ct>Networking

Detach a container from a network.

docker network disconnect app-net web

docker network rm app-netNetworking

Remove a network; detach containers first.

docker network rm app-net

docker port <ct>Networking

Show the port mappings of a container.

docker port web

docker run --network app-net --name api app:1.0Networking

On a user-defined network, containers resolve each other by name.

docker run -d --network app-net --name api app:1.0

docker volume lsVolumes

List all volumes.

docker volume ls -f dangling=true

docker volume create pgdataVolumes

Create a named volume for easier backup and migration.

docker volume create pgdata

docker volume inspect pgdataVolumes

Show where the volume lives on the host.

docker volume inspect --format "{{.Mountpoint}}" pgdata

docker run -v $(pwd)/data:/data app:1.0Volumes

Bind-mount a host directory so edits apply immediately.

docker run -d -v $(pwd)/data:/app/data app:1.0

docker run -v $(pwd)/nginx.conf:/etc/nginx/nginx.conf:ro nginxVolumes

Mount config read-only so the container cannot modify the host file.

docker run -d -v $(pwd)/nginx.conf:/etc/nginx/nginx.conf:ro nginx

docker volume rm pgdataVolumes

Remove a volume; delete using containers first.

docker volume rm pgdata

docker volume pruneVolumes

Remove dangling volumes not used by any container.

docker volume prune -f

docker inspect -f "{{.Mounts}}" <ct>Volumes

Show what a container actually mounts, useful when configs seem ignored.

docker inspect -f "{{json .Mounts}}" web

docker compose up -dCompose

Start all services in the background.

docker compose up -d

docker compose up -d --buildCompose

Rebuild images before starting; needed after Dockerfile changes.

docker compose up -d --build

docker compose downCompose

Stop and remove containers and networks, keeping volumes.

docker compose down

docker compose down -vCompose

Also remove volumes. Destructive.

docker compose down -v --remove-orphans

docker compose psCompose

Show container status for this project.

docker compose ps -a

docker compose logs -f apiCompose

Follow logs of one service.

docker compose logs -f --tail 100 api

docker compose exec api shCompose

Open a shell in a service container.

docker compose exec api /bin/sh

docker compose restart apiCompose

Restart one service without touching the others.

docker compose restart api

docker compose pullCompose

Pull the latest images referenced in the compose file.

docker compose pull

docker compose configCompose

Render the resolved compose config to validate syntax and variables.

docker compose config

docker compose up -d --scale web=3Compose

Scale to three replicas; fixed host ports no longer allowed.

docker compose up -d --scale web=3

docker compose --profile debug upCompose

Bring up services under a specific profile.

docker compose --profile debug up -d

docker logout registry.example.comRegistries

Log out and clear stored credentials.

docker logout registry.example.com

docker push registry.example.com/app:1.0Registries

Push an image; tag it with the registry path first.

docker push registry.example.com/team/app:1.0

docker search nginxRegistries

Search Docker Hub for images.

docker search --limit 10 nginx

docker manifest inspect nginx:latestRegistries

Show which architectures an image supports.

docker manifest inspect nginx:latest

docker buildx imagetools inspect app:1.0Registries

Inspect the manifest of a remote multi-arch image.

docker buildx imagetools inspect registry.example.com/app:1.0

docker system dfCleanup

Show disk usage of images, containers, volumes, and build cache.

docker system df -v

docker system pruneCleanup

Remove stopped containers, unused networks, and dangling images.

docker system prune -f

docker system prune -a --volumesCleanup

Also remove unused images and volumes. Destructive.

docker system prune -a --volumes -f

docker builder pruneCleanup

Clear build cache only, for when it eats your disk.

docker builder prune -a -f

docker container pruneCleanup

Remove all stopped containers.

docker container prune -f --filter "until=24h"

docker image pruneCleanup

Remove dangling images; -a also removes unused ones.

docker image prune -a -f

docker network pruneCleanup

Remove networks with no containers attached.

docker network prune -f

docker rm -v $(docker ps -aq)Cleanup

Remove every container, including anonymous volumes.

docker rm -f -v $(docker ps -aq)

docker logs -f --tail 100 webDebug and resources

Follow the last 100 log lines; the first stop for debugging.

docker logs -f --tail 100 web

docker logs --since 10m webDebug and resources

Show logs from the last ten minutes.

docker logs --since 10m --timestamps web

docker inspect -f "{{.State.Status}}" webDebug and resources

Read container state in a script-friendly form.

docker inspect -f "{{.State.Status}} exit={{.State.ExitCode}}" web

docker inspect -f "{{.State.ExitCode}}" <ct>Debug and resources

Check the exit code; 137 usually means OOM-killed.

docker inspect -f "{{.State.ExitCode}}" web

docker statsDebug and resources

Live CPU, memory, and network usage per container.

docker stats --no-stream

docker top <ct>Debug and resources

Show processes inside a container.

docker top web

docker eventsDebug and resources

Stream Docker events to see when containers die or restart.

docker events --filter "container=web"

docker run -it --rm --entrypoint sh app:1.0Debug and resources

Override the entrypoint to inspect an image that will not start.

docker run -it --rm --entrypoint sh app:1.0

docker run -it --rm --network container:web nicolaka/netshootDebug and resources

Borrow a network-toolbox image sharing the target container network.

docker run -it --rm --network container:web nicolaka/netshoot

docker build --progress=plain -t app:1.0 .Debug and resources

Print full build output to locate the failing step.

docker build --progress=plain --no-cache -t app:1.0 .

docker inspect -f "{{json .HostConfig.RestartPolicy}}" <ct>Debug and resources

Verify the restart policy is actually applied.

docker inspect -f "{{json .HostConfig.RestartPolicy}}" web

docker diff <ct> | head -50Debug and resources

Quickly see which files changed inside a container.

docker diff web | head -50

Something broken or missing?

Send feedback