docker
46 commands
46 shown
Multi-platform build and push
Cross-compile and push directly to registry with BuildKit
docker buildx build --platform linux/amd64,linux/arm64 -t reg/img:tag --push .
Run container with env file
Local run with env vars from file; --rm auto-removes on exit
docker run --rm -it --env-file .env -p 8000:8000 img:tag
Inspect image layers
See each layer, its command, and size; identify bloat
docker history --no-trunc img:tag
Prune everything unused
Remove stopped containers, unused images, networks, volumes
docker system prune -af --volumes
Copy image between registries
Re-tag and push to another registry
docker pull src-reg/img:tag && docker tag src-reg/img:tag dst-reg/img:tag && docker push dst-reg/img:tag
Save image to tarball
Export an image for air-gapped transfer
docker save img:tag | gzip > img.tar.gz
Build with build args
Pass build-time variables into Dockerfile ARG instructions
docker build --build-arg VERSION=1.2.3 --build-arg ENV=prod -t img:tag .
Scan image with Trivy
Fail pipeline if HIGH or CRITICAL CVEs found
trivy image --exit-code 1 --severity HIGH,CRITICAL img:tag
Check image SBOM
Generate Software Bill of Materials for an image (Docker Desktop)
docker sbom img:tag
Inspect running container
Drill into network settings of a running container
docker inspect <container> | jq '.[0].NetworkSettings.Networks'
Docker compose up detached
Build and start all services in background
docker compose up -d --build
Docker compose logs follow
Stream last 100 lines and follow a compose service
docker compose logs -f --tail=100 <service>
Docker compose down with volumes
Stop and remove containers, networks, and volumes
docker compose down -v
List container disk usage
Detailed breakdown of disk usage per image, container, volume
docker system df -v
Docker exec as root
Enter container as root even if default user is non-root
docker exec -it -u root <container> bash
Copy file into running container
Inject a file into a running container without rebuild
docker cp ./local-file.conf <container>:/etc/app/config.conf
Load image from tarball
Import an image exported with docker save
docker load < img.tar.gz
Docker registry garbage collect
Free disk space in a self-hosted Docker Registry
docker exec -it registry bin/registry garbage-collect /etc/docker/registry/config.yml
Multi-stage build target
Build only up to a specific stage in a multi-stage Dockerfile
docker build --target builder -t img:builder .
Build with build args
Pass build-time variables to Dockerfile ARG instructions
docker build --build-arg APP_VERSION=1.2.3 --build-arg ENV=prod -t myapp:1.2.3 .
Multi-platform build
Build and push multi-arch image using BuildKit
docker buildx build --platform linux/amd64,linux/arm64 -t myapp:latest --push .
Inspect image layers
Show all layers with full commands and sizes
docker history --no-trunc <image>
Export container filesystem
Inspect a container's merged filesystem as a tar stream
docker export <container> | tar -tvf - | head -30
Diff container from image
Files added (A), changed (C), or deleted (D) in a running container
docker diff <container>
Commit container to image
Snapshot a running container's filesystem as an image
docker commit -m 'debug snapshot' <container> debug-snapshot:$(date +%s)
Run with resource limits
Limit container to 512MB RAM and half a CPU core
docker run --memory=512m --cpus=0.5 --oom-kill-disable=false myapp
Show container resource usage
One-shot CPU and memory snapshot for all containers
docker stats --no-stream --format 'table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}'
Remove dangling images
Remove all <none>:<none> dangling images
docker image prune -f
Remove everything unused
Remove stopped containers, unused images, networks, volumes
docker system prune -a --volumes -f
Copy file from container
Extract a single file from a running or stopped container
docker cp <container>:/app/config.yaml ./local-config.yaml
Docker compose up detached
Rebuild and start services, remove containers not in compose file
docker compose up -d --build --remove-orphans
Scale a compose service
Run 5 replicas of the worker service
docker compose up -d --scale worker=5
Print compose service logs
Stream last 100 lines of a specific compose service
docker compose logs -f --tail=100 worker
Inspect network
Show IPs of all containers in the bridge network
docker network inspect bridge | jq '.[0].Containers | to_entries[] | .value | {Name, IPv4Address}'
Create custom network
Create a bridge network with a custom subnet
docker network create --driver bridge --subnet 172.30.0.0/24 mynet
Save and load image
Export image to archive and reimport on another host
docker save myapp:1.0 | gzip > myapp.tar.gz && docker load < myapp.tar.gz
Healthcheck in Dockerfile
Native Docker healthcheck with curl (add to Dockerfile)
HEALTHCHECK --interval=10s --timeout=3s --retries=3 CMD curl -sf http://localhost:8080/health || exit 1
Docker scout vulnerabilities
Show only CVEs that already have a fix available
docker scout cves --only-fixed myapp:latest
Run temporary debug container
Full-featured network debug container sharing host PID and network
docker run --rm -it --pid=host --network=host --privileged nicolaka/netshoot
Build matrix from bake file
Build/push multiple targets from one HCL file; parallel, DRY group definitions
docker buildx bake -f docker-bake.hcl --push
Inspect multi-arch manifest
Show platforms in a manifest list without pulling layers; verify arm64+amd64
docker buildx imagetools inspect <reg>/<name>:tag --format '{{json .Manifest}}'
Container driver builder
Create a BuildKit builder supporting multi-arch and cache export; default driver cannot
docker buildx create --name multi --use --driver docker-container --driver-opt network=host
Pass build secret from file
Feed a secret to BuildKit; only RUN --mount=type=secret,id=token sees it, not history
docker buildx build --secret id=token,src=token.txt -t <name> .
Remote daemon over SSH
Run docker against a remote daemon over SSH; no exposed TCP socket needed
docker context create remote --docker host=ssh://<host> && docker context use remote
Hardened read-only container
Immutable rootfs, writable /tmp only, block privilege escalation; container hardening
docker run --read-only --tmpfs /tmp --security-opt no-new-privileges --cap-drop ALL <name>
Watch for OOM kills
Stream live OOM events to catch memory-limited containers being killed
docker events --filter event=oom --filter type=container
no commands match