docker commands

46 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 46 shown

  • Multi-platform build and push
    docker buildx build --platform linux/amd64,linux/arm64 -t reg/img:tag --push .

    Cross-compile and push directly to registry with BuildKit

  • Run container with env file
    docker run --rm -it --env-file .env -p 8000:8000 img:tag

    Local run with env vars from file; --rm auto-removes on exit

  • Inspect image layers
    docker history --no-trunc img:tag

    See each layer, its command, and size; identify bloat

    debug

  • Prune everything unused
    docker system prune -af --volumes

    Remove stopped containers, unused images, networks, volumes

  • Copy image between registries
    docker pull src-reg/img:tag && docker tag src-reg/img:tag dst-reg/img:tag && docker push dst-reg/img:tag

    Re-tag and push to another registry

  • Save image to tarball
    docker save img:tag | gzip > img.tar.gz

    Export an image for air-gapped transfer

  • Build with build args
    docker build --build-arg VERSION=1.2.3 --build-arg ENV=prod -t img:tag .

    Pass build-time variables into Dockerfile ARG instructions

  • Scan image with Trivy
    trivy image --exit-code 1 --severity HIGH,CRITICAL img:tag

    Fail pipeline if HIGH or CRITICAL CVEs found

    security

  • Check image SBOM
    docker sbom img:tag

    Generate Software Bill of Materials for an image (Docker Desktop)

    security

  • Inspect running container
    docker inspect <container> | jq '.[0].NetworkSettings.Networks'

    Drill into network settings of a running container

    debug · network

  • Docker compose up detached
    docker compose up -d --build

    Build and start all services in background

    compose

  • Docker compose logs follow
    docker compose logs -f --tail=100 <service>

    Stream last 100 lines and follow a compose service

    compose · logs

  • Docker compose down with volumes
    docker compose down -v

    Stop and remove containers, networks, and volumes

    compose

  • List container disk usage
    docker system df -v

    Detailed breakdown of disk usage per image, container, volume

  • Docker exec as root
    docker exec -it -u root <container> bash

    Enter container as root even if default user is non-root

    debug

  • Copy file into running container
    docker cp ./local-file.conf <container>:/etc/app/config.conf

    Inject a file into a running container without rebuild

    debug

  • Load image from tarball
    docker load < img.tar.gz

    Import an image exported with docker save

  • Docker registry garbage collect
    docker exec -it registry bin/registry garbage-collect /etc/docker/registry/config.yml

    Free disk space in a self-hosted Docker Registry

  • Multi-stage build target
    docker build --target builder -t img:builder .

    Build only up to a specific stage in a multi-stage Dockerfile

  • Build with build args
    docker build --build-arg APP_VERSION=1.2.3 --build-arg ENV=prod -t myapp:1.2.3 .

    Pass build-time variables to Dockerfile ARG instructions

  • Multi-platform build
    docker buildx build --platform linux/amd64,linux/arm64 -t myapp:latest --push .

    Build and push multi-arch image using BuildKit

  • Inspect image layers
    docker history --no-trunc <image>

    Show all layers with full commands and sizes

    debug

  • Export container filesystem
    docker export <container> | tar -tvf - | head -30

    Inspect a container's merged filesystem as a tar stream

    debug

  • Diff container from image
    docker diff <container>

    Files added (A), changed (C), or deleted (D) in a running container

    debug

  • Commit container to image
    docker commit -m 'debug snapshot' <container> debug-snapshot:$(date +%s)

    Snapshot a running container's filesystem as an image

    debug

  • Run with resource limits
    docker run --memory=512m --cpus=0.5 --oom-kill-disable=false myapp

    Limit container to 512MB RAM and half a CPU core

    performance

  • Show container resource usage
    docker stats --no-stream --format 'table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}'

    One-shot CPU and memory snapshot for all containers

    monitoring

  • Remove dangling images
    docker image prune -f

    Remove all <none>:<none> dangling images

  • Remove everything unused
    docker system prune -a --volumes -f

    Remove stopped containers, unused images, networks, volumes

  • Copy file from container
    docker cp <container>:/app/config.yaml ./local-config.yaml

    Extract a single file from a running or stopped container

    debug

  • Docker compose up detached
    docker compose up -d --build --remove-orphans

    Rebuild and start services, remove containers not in compose file

  • Scale a compose service
    docker compose up -d --scale worker=5

    Run 5 replicas of the worker service

  • Print compose service logs
    docker compose logs -f --tail=100 worker

    Stream last 100 lines of a specific compose service

    logs

  • Inspect network
    docker network inspect bridge | jq '.[0].Containers | to_entries[] | .value | {Name, IPv4Address}'

    Show IPs of all containers in the bridge network

    network

  • Create custom network
    docker network create --driver bridge --subnet 172.30.0.0/24 mynet

    Create a bridge network with a custom subnet

    network

  • Save and load image
    docker save myapp:1.0 | gzip > myapp.tar.gz && docker load < myapp.tar.gz

    Export image to archive and reimport on another host

  • Healthcheck in Dockerfile
    HEALTHCHECK --interval=10s --timeout=3s --retries=3 CMD curl -sf http://localhost:8080/health || exit 1

    Native Docker healthcheck with curl (add to Dockerfile)

  • Docker scout vulnerabilities
    docker scout cves --only-fixed myapp:latest

    Show only CVEs that already have a fix available

    security

  • Run temporary debug container
    docker run --rm -it --pid=host --network=host --privileged nicolaka/netshoot

    Full-featured network debug container sharing host PID and network

    debug · network

  • Build matrix from bake file
    docker buildx bake -f docker-bake.hcl --push

    Build/push multiple targets from one HCL file; parallel, DRY group definitions

    buildkit · ci · performance

  • Inspect multi-arch manifest
    docker buildx imagetools inspect <reg>/<name>:tag --format '{{json .Manifest}}'

    Show platforms in a manifest list without pulling layers; verify arm64+amd64

    buildkit · troubleshooting · cloud

  • Container driver builder
    docker buildx create --name multi --use --driver docker-container --driver-opt network=host

    Create a BuildKit builder supporting multi-arch and cache export; default driver cannot

    buildkit · ci

  • Pass build secret from file
    docker buildx build --secret id=token,src=token.txt -t <name> .

    Feed a secret to BuildKit; only RUN --mount=type=secret,id=token sees it, not history

    buildkit · secrets · security

  • Remote daemon over SSH
    docker context create remote --docker host=ssh://<host> && docker context use remote

    Run docker against a remote daemon over SSH; no exposed TCP socket needed

    network · security

  • Hardened read-only container
    docker run --read-only --tmpfs /tmp --security-opt no-new-privileges --cap-drop ALL <name>

    Immutable rootfs, writable /tmp only, block privilege escalation; container hardening

    security · kernel

  • Watch for OOM kills
    docker events --filter event=oom --filter type=container

    Stream live OOM events to catch memory-limited containers being killed

    monitoring · troubleshooting · performance