Docker cheatsheet

Searchable reference of Docker and Docker Compose commands for images, containers, volumes and networks.

Section

149 of 149 commands

Docker commands
Section	Command	Description
Run	docker run <image>	Create and start a container from an image, pulling it if needed.
Run	docker run -it --rm <image> sh	Interactive shell in a throwaway container, removed on exit.
Run	docker run -d --name <name> <image>	Run in the background with a fixed name.
Run	docker run -p 8080:80 <image>	Publish container port 80 on host port 8080 (all interfaces).
Run	docker run -p 127.0.0.1:8080:80 <image>	Publish a port on localhost only.
Run	docker run -P <image>	Publish every EXPOSEd port on a random host port.
Run	docker run -e KEY=value <image>	Set an environment variable.
Run	docker run --env-file .env <image>	Load environment variables from a file.
Run	docker run -v <volume>:/data <image>	Mount a named volume at /data (created if missing).
Run	docker run -v "$PWD":/app -w /app <image>	Bind-mount the current directory and make it the working directory.
Run	docker run --mount type=bind,src=<host-path>,dst=<path>,readonly <image>	Explicit bind mount; fails instead of creating the host path if it is missing.
Run	docker run --tmpfs /tmp <image>	Mount an in-memory filesystem.
Run	docker run --network <network> <image>	Attach the container to a network.
Run	docker run --restart unless-stopped <image>	Restart after crashes and daemon restarts unless stopped by hand.
Run	docker run --user 1000:1000 <image>	Run as a specific UID:GID instead of the image default.
Run	docker run --read-only --cap-drop ALL --security-opt no-new-privileges <image>	Hardened run: read-only root filesystem, no capabilities, no privilege escalation.
Run	docker run --memory 512m --cpus 1.5 <image>	Limit memory and CPU.
Run	docker run --entrypoint sh <image>	Override the image ENTRYPOINT.
Run	docker run --platform linux/arm64 <image>	Run an image built for another platform (needs emulation).
Run	docker run --init <image>	Run a tiny init as PID 1 to forward signals and reap zombies.
Run	docker run --gpus all <image>	Give the container access to all GPUs (NVIDIA Container Toolkit).
Run	docker run --add-host host.docker.internal:host-gateway <image>	Let a container on Linux reach the host as host.docker.internal.
Containers	docker ps	List running containers.
Containers	docker ps -a	List all containers, including stopped ones.
Containers	docker ps -q	Print only container IDs, handy for scripting.
Containers	docker ps --filter status=exited	List containers that have exited.
Containers	docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"	Custom columns with a Go template.
Containers	docker start <container>	Start a stopped container.
Containers	docker stop <container>	Stop gracefully: SIGTERM, then SIGKILL after 10 s.
Containers	docker restart <container>	Stop and start a container.
Containers	docker kill <container>	Stop immediately with SIGKILL (or --signal).
Containers	docker pause <container>	Freeze all processes in a container; resume with docker unpause.
Containers	docker rm <container>	Remove a stopped container.
Containers	docker rm -f <container>	Force-remove a container, stopping it first.
Containers	docker rename <old> <new>	Rename a container.
Containers	docker inspect <container>	Full JSON configuration and state.
Containers	docker inspect -f "{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}" <container>	Print the container IP addresses.
Containers	docker port <container>	Show port mappings.
Containers	docker stats	Live CPU, memory, network and disk usage per container.
Containers	docker top <container>	List the processes running in a container.
Containers	docker cp <container>:<path> <host-path>	Copy files out of a container.
Containers	docker cp <host-path> <container>:<path>	Copy files into a container.
Containers	docker diff <container>	Files added (A), changed (C) or deleted (D) since the container started.
Containers	docker update --restart no <container>	Change restart policy or resource limits of a container.
Containers	docker wait <container>	Block until a container stops, then print its exit code.
Containers	docker export -o <file>.tar <container>	Export the container filesystem as a tar archive.
Exec & logs	docker exec -it <container> sh	Open a shell in a running container.
Exec & logs	docker exec -it -u root <container> sh	Open a shell as root.
Exec & logs	docker exec -e KEY=value <container> <command>	Run a command with an extra environment variable.
Exec & logs	docker exec -w /app <container> <command>	Run a command in a given working directory.
Exec & logs	docker logs <container>	Print the container output (stdout and stderr).
Exec & logs	docker logs -f <container>	Follow the log output.
Exec & logs	docker logs -f --tail 100 <container>	Follow, starting from the last 100 lines.
Exec & logs	docker logs --since 10m <container>	Logs from the last 10 minutes (or a timestamp).
Exec & logs	docker logs -t <container>	Prefix each line with a timestamp.
Exec & logs	docker attach <container>	Attach to the main process; detach with Ctrl-p Ctrl-q.
Images	docker images	List local images (same as docker image ls).
Images	docker image ls --filter dangling=true	List untagged (dangling) images.
Images	docker pull <image>:<tag>	Download an image from a registry.
Images	docker pull --platform linux/amd64 <image>	Pull the variant for a specific platform.
Images	docker tag <image> <registry>/<repo>:<tag>	Add a new name to an image, e.g. before pushing.
Images	docker rmi <image>	Remove an image (same as docker image rm).
Images	docker image inspect <image>	JSON details: layers, env, entrypoint, labels.
Images	docker history <image>	Show the layers of an image and the instruction that made each one.
Images	docker save -o <file>.tar <image>	Save one or more images to a tar archive.
Images	docker load -i <file>.tar	Load images from a tar archive.
Images	docker commit <container> <image>	Create an image from a container’s changes (prefer a Dockerfile).
Images	docker search <term>	Search Docker Hub for images.
Build	docker build -t <name>:<tag> .	Build an image from the Dockerfile in the current directory.
Build	docker build -f <path>/Dockerfile .	Use a Dockerfile in another location.
Build	docker build --build-arg KEY=value .	Set a build-time ARG.
Build	docker build --target <stage> .	Build only up to a stage of a multi-stage Dockerfile.
Build	docker build --no-cache .	Rebuild every layer, ignoring the cache.
Build	docker build --pull .	Always pull a newer version of the base images.
Build	docker build --progress=plain .	Plain build output, showing the full output of every step.
Build	docker build --secret id=<id>,src=<file> .	Pass a secret file to RUN --mount=type=secret,id=<id> without storing it in a layer.
Build	docker build --ssh default .	Forward your SSH agent to RUN --mount=type=ssh steps.
Build	docker build -o <dir> .	Export the build result as files to a directory instead of an image.
Build	docker build --check .	Run the Dockerfile build checks without building.
Build	docker buildx build --platform linux/amd64,linux/arm64 -t <image> --push .	Build a multi-platform image and push it.
Build	docker buildx create --name <builder> --use	Create a docker-container builder and make it the default.
Build	docker buildx ls	List builders and the platforms they support.
Build	docker buildx bake	Build several targets defined in docker-bake.hcl or a Compose file.
Build	docker buildx du	Show build cache disk usage.
Build	docker builder prune	Remove the build cache.
Registry	docker login	Log in to Docker Hub.
Registry	docker login <registry>	Log in to another registry, e.g. ghcr.io.
Registry	echo "$TOKEN" \| docker login -u <user> --password-stdin <registry>	Log in without the token in shell history.
Registry	docker logout <registry>	Remove stored credentials.
Registry	docker push <registry>/<repo>:<tag>	Upload an image to a registry.
Registry	docker buildx imagetools inspect <image>	Show the manifest list and platforms of a remote image.
Registry	docker scout cves <image>	List known vulnerabilities in an image (Docker Scout plugin).
Volumes	docker volume create <name>	Create a named volume.
Volumes	docker volume ls	List volumes.
Volumes	docker volume inspect <name>	Show a volume’s driver, mount point and labels.
Volumes	docker volume rm <name>	Remove a volume that no container uses.
Volumes	docker volume prune	Remove unused anonymous volumes.
Volumes	docker volume prune -a	Remove all unused volumes, named ones included.
Volumes	docker run --rm -v <volume>:/data -v "$PWD":/backup alpine tar czf /backup/backup.tgz -C /data .	Back up a volume to a tarball in the current directory.
Networks	docker network ls	List networks.
Networks	docker network create <name>	Create a user-defined bridge network; containers on it resolve each other by name.
Networks	docker network create --subnet 172.28.0.0/16 <name>	Create a network with a fixed subnet.
Networks	docker network connect <network> <container>	Attach a running container to a network.
Networks	docker network connect --alias <alias> <network> <container>	Attach with an extra DNS name.
Networks	docker network disconnect <network> <container>	Detach a container from a network.
Networks	docker network inspect <network>	Show the subnet and connected containers.
Networks	docker network rm <network>	Remove a network.
Networks	docker network prune	Remove all unused networks.
Networks	docker run --network host <image>	Share the host network stack (no port publishing needed).
Networks	docker run --network none <image>	Run with networking disabled.
System & cleanup	docker version	Client and server versions.
System & cleanup	docker info	Daemon configuration: storage driver, cgroups, number of containers.
System & cleanup	docker system df	Disk used by images, containers, volumes and build cache.
System & cleanup	docker system df -v	Disk usage per image, container and volume.
System & cleanup	docker system prune	Remove stopped containers, unused networks, dangling images and build cache.
System & cleanup	docker system prune -a --volumes	Also remove every unused image and anonymous volume. Destructive.
System & cleanup	docker container prune	Remove all stopped containers.
System & cleanup	docker image prune	Remove dangling images.
System & cleanup	docker image prune -a	Remove every image not used by a container.
System & cleanup	docker image prune -a --filter "until=168h"	Remove unused images older than a week.
System & cleanup	docker events	Stream real-time events from the daemon.
System & cleanup	docker context ls	List contexts (local and remote Docker endpoints).
System & cleanup	docker context create <name> --docker host=ssh://<user>@<host>	Add a remote Docker host reached over SSH.
System & cleanup	docker context use <name>	Send subsequent commands to another Docker endpoint.
Compose	docker compose up -d	Create and start every service in the background.
Compose	docker compose up -d --build	Rebuild images before starting.
Compose	docker compose up -d <service>	Start one service and its dependencies.
Compose	docker compose up -d --force-recreate	Recreate containers even if their configuration is unchanged.
Compose	docker compose up --wait	Start and wait until services are running or healthy.
Compose	docker compose up -d --scale <service>=3	Run three replicas of a service.
Compose	docker compose down	Stop and remove containers and networks.
Compose	docker compose down -v	Also remove named and anonymous volumes. Deletes data.
Compose	docker compose ps	List the project’s containers.
Compose	docker compose logs -f <service>	Follow the logs of a service.
Compose	docker compose exec <service> sh	Open a shell in a running service container.
Compose	docker compose run --rm <service> <command>	Run a one-off command in a new container.
Compose	docker compose build	Build or rebuild service images.
Compose	docker compose pull	Pull the latest images for every service.
Compose	docker compose restart <service>	Restart a service (does not apply config changes).
Compose	docker compose stop	Stop services without removing them.
Compose	docker compose config	Print the merged, interpolated configuration.
Compose	docker compose -f compose.yaml -f compose.prod.yaml up -d	Merge several Compose files, later ones win.
Compose	docker compose -p <project> up -d	Use a specific project name.
Compose	docker compose --profile <profile> up -d	Also start services assigned to a profile.
Compose	docker compose --env-file <file> up -d	Use another file for variable interpolation.
Compose	docker compose watch	Sync or rebuild services when files change (develop.watch).
Compose	docker compose ls	List running Compose projects.
Compose	docker compose top	Show the processes of every service.
Compose	docker compose cp <service>:<path> <host-path>	Copy files out of a service container.