Docker Cheat Sheet: Commands, Flags, Compose, Volumes, Networks

Docker has a wide CLI surface but the part you actually use day to day is small. This is the working set I reach for: images, container lifecycle, run flags, exec and logs, build, networks, volumes, Compose, registry, and the prune commands that keep a host from filling up. Generic placeholders like IMAGE_NAME, CONTAINER_NAME, HOST_PORT, VOLUME_NAME are swappable from the input above the cheat sheet, so you can type IMAGE_NAME=postgres:16, HOST_PORT=5432 and every example below updates in place.

For the longer-form pieces (writing a Dockerfile, Compose, multi-stage builds, troubleshooting), see the linked articles in the What to do next section.

Docker Cheat Sheet

The commands I actually use, grouped by job. Use the variables input to swap placeholders like IMAGE_NAME or CONTAINER_NAME across every example.

Daemon and info

docker versionClient and engine versions

docker infoEngine status, storage driver, image/container counts, host info

docker context lsList docker contexts (default, desktop-linux, remote)

docker context use CONTEXT_NAMESwitch the active context

sudo systemctl status dockerLinux: is the daemon running

sudo systemctl start dockerLinux: start the daemon

Images

docker pull IMAGE_NAMEPull an image from the registry

docker imagesList images on this host

docker image ls -aList all images including intermediates

docker rmi IMAGE_NAMERemove an image

docker image pruneRemove dangling images (untagged)

docker image prune -aRemove all unused images, tagged or not

docker tag IMAGE_NAME REGISTRY/REPO:TAGTag an image for push

docker image inspect IMAGE_NAMEFull metadata, env, entrypoint, labels

docker image history IMAGE_NAMELayer history with sizes — audit what bloats the image

docker manifest inspect IMAGE_NAMEShow platforms an image supports (arm64, amd64)

Container lifecycle

docker run IMAGE_NAMEStart a container from an image

docker psList running containers

docker ps -aList all containers including stopped

docker stop CONTAINER_NAMESend SIGTERM then SIGKILL after 10s

docker start CONTAINER_NAMEStart a stopped container

docker restart CONTAINER_NAMEStop + start

docker kill CONTAINER_NAMESIGKILL immediately

docker pause CONTAINER_NAMEFreeze all processes with cgroups

docker unpause CONTAINER_NAMEResume a paused container

docker rm CONTAINER_NAMERemove a stopped container

docker rm -f CONTAINER_NAMEForce remove, stops first

docker container pruneRemove all stopped containers

docker rename OLD NEWRename a container

docker run — the flags worth knowing

docker run -d IMAGE_NAMEDetached / background

docker run -it IMAGE_NAME bashInteractive shell, allocate a TTY

docker run --rm IMAGE_NAMERemove container automatically when it exits

docker run --name CONTAINER_NAME IMAGE_NAMEName the container instead of getting a random one

docker run -p HOST_PORT:CONTAINER_PORT IMAGE_NAMEPublish a container port to the host

docker run -p 127.0.0.1:HOST_PORT:CONTAINER_PORT IMAGE_NAMEPublish on a specific host interface only (localhost-only)

docker run -v VOLUME_NAME:/path/in/container IMAGE_NAMENamed volume mount

docker run -v /host/path:/path/in/container IMAGE_NAMEBind mount a host path

docker run -v /host/path:/path/in/container:ro IMAGE_NAMERead-only bind mount

docker run -e KEY=VALUE IMAGE_NAMESingle env var

docker run --env-file .env IMAGE_NAMELoad env vars from a file

docker run --network NETWORK_NAME IMAGE_NAMEAttach to a user-defined network

docker run --restart unless-stopped IMAGE_NAMERestart on crash/host reboot, unless you stopped it manually

docker run --user 1000:1000 IMAGE_NAMERun as a specific UID:GID instead of root

docker run --memory 512m --cpus 0.5 IMAGE_NAMEResource limits

docker run --platform linux/amd64 IMAGE_NAMEForce the platform (Apple Silicon running x86 images)

docker run --hostname HOST IMAGE_NAMESet the container's hostname

docker run --workdir /app IMAGE_NAMESet the working directory inside the container

docker run --entrypoint sh IMAGE_NAMEOverride the image's ENTRYPOINT

docker run --add-host db:192.168.1.10 IMAGE_NAMEAdd a /etc/hosts entry inside the container

Exec, inspect, logs

docker exec -it CONTAINER_NAME bashShell into a running container

docker exec -it CONTAINER_NAME shUse sh when bash is not installed (alpine images)

docker exec -it --user root CONTAINER_NAME bashForce root for installing tools or fixing permissions

docker exec CONTAINER_NAME ls /appRun a single non-interactive command

docker logs CONTAINER_NAMEContainer output (stdout + stderr)

docker logs -f CONTAINER_NAMEFollow logs (tail -f)

docker logs --tail 100 CONTAINER_NAMELast 100 lines only

docker logs --since 10m CONTAINER_NAMELast 10 minutes

docker logs --since 2026-05-01 CONTAINER_NAMESince a specific date

docker logs --timestamps CONTAINER_NAMEPrepend ISO timestamps to each line

docker inspect CONTAINER_NAMEFull JSON: mounts, env, network IPs, state, exit codes

docker inspect --format '{{.State.Status}}' CONTAINER_NAMEPluck one field with a Go template

docker top CONTAINER_NAMEProcesses running inside the container

docker statsLive CPU, memory, network, disk per container

docker port CONTAINER_NAMEShow port mappings for one container

docker diff CONTAINER_NAMEFiles changed since the image was created

docker cp CONTAINER_NAME:/path /host/pathCopy a file out of a container

docker cp /host/file CONTAINER_NAME:/pathCopy a file into a container

Build

docker build -t IMAGE_NAME .Build from the Dockerfile in the current directory

docker build -t IMAGE_NAME -f path/to/Dockerfile .Use a Dockerfile somewhere other than ./Dockerfile

docker build --no-cache -t IMAGE_NAME .Force a full rebuild

docker build --build-arg KEY=VALUE -t IMAGE_NAME .Pass a build-time ARG

docker build --target STAGE -t IMAGE_NAME .Stop at a multi-stage target (e.g. build dev image from a 'dev' stage)

docker build --platform linux/amd64,linux/arm64 -t IMAGE_NAME .Build for multiple architectures (needs buildx)

docker buildx create --useCreate and switch to a buildx builder (multi-arch)

docker buildx build --platform linux/amd64,linux/arm64 --push -t IMAGE_NAME .Multi-arch build pushed to a registry as a manifest list

docker builder pruneClean the BuildKit cache (separate from docker system prune)

Networks

docker network lsList networks

docker network create NETWORK_NAMECreate a user-defined bridge (service-name DNS works on these)

docker network inspect NETWORK_NAMEShow subnet, gateway, connected containers

docker network connect NETWORK_NAME CONTAINER_NAMEAttach a running container to a network

docker network disconnect NETWORK_NAME CONTAINER_NAMEDetach

docker network rm NETWORK_NAMERemove an empty network

docker network pruneRemove all unused networks

Volumes

docker volume lsList named volumes

docker volume create VOLUME_NAMEPre-create a named volume

docker volume inspect VOLUME_NAMEDriver, mountpoint, labels

docker volume rm VOLUME_NAMERemove a volume (must not be in use)

docker volume pruneRemove all unused volumes (data loss potential)

docker run --rm -v VOLUME_NAME:/from -v $(pwd):/to alpine tar czf /to/backup.tar.gz -C /from .Back up a named volume to a tar.gz on the host

docker run --rm -v VOLUME_NAME:/to -v $(pwd):/from alpine tar xzf /from/backup.tar.gz -C /toRestore a named volume from a tar.gz

Docker Compose (V2: docker compose, no hyphen)

docker compose upStart the stack in the current directory's docker-compose.yml

docker compose up -dDetached

docker compose up --buildRebuild images before starting

docker compose downStop and remove containers + networks

docker compose down -vAlso remove named volumes (data loss)

docker compose psStack-scoped container list

docker compose logs -f SERVICE_NAMEFollow logs for one service

docker compose exec SERVICE_NAME bashShell into a Compose service

docker compose restart SERVICE_NAMERestart one service

docker compose build SERVICE_NAMEBuild just one service's image

docker compose pullPull image updates for every service

docker compose run --rm SERVICE_NAME COMMANDRun a one-off command in the service's image

docker compose configValidate and print the merged compose file

docker compose top SERVICE_NAMEProcesses in a Compose service

Registry — push, pull, login

docker login REGISTRYLogin to a registry (Docker Hub if no host given)

docker logout REGISTRYLogout

docker tag IMAGE_NAME REGISTRY/REPO:TAGTag for a registry before push

docker push REGISTRY/REPO:TAGPush to the registry

docker pull REGISTRY/REPO:TAGPull from a private registry

Cleanup and disk space

docker system dfDisk usage by images, containers, volumes, build cache

docker system pruneRemove stopped containers, unused networks, dangling images, build cache

docker system prune -aAlso remove ALL unused images (not just dangling)

docker system prune -a --volumesThe nuclear option: also wipes unused volumes (data loss)

docker builder pruneBuildKit cache only

docker image prune -aUnused images only

docker container pruneStopped containers only

docker network pruneUnused networks only

docker volume pruneUnused volumes only (data loss potential)

Events and debugging

docker eventsStream the daemon event log (container start/stop/oom etc.)

docker events --filter event=oomOnly OOM kills

docker container inspect --format '{{.State.ExitCode}}' CONTAINER_NAMEExit code of the last run

docker container inspect --format '{{.State.OOMKilled}}' CONTAINER_NAMEWas it OOM-killed (exit code 137)