TechEarl

Docker Cheat Sheet

The Docker commands I actually use, grouped by job: images, container lifecycle, run flags, exec and logs, build, networks, volumes, Compose, registry, and the prune/inspect commands for keeping a host clean.

Ishan Karunaratne⏱️ 4 min readUpdated
Share thisCopied
A working Docker cheat sheet: images, container lifecycle, run flags, exec, logs, build, networks, volumes, Compose, registry, and prune commands. With swappable variables.

Docker Cheat Sheet

The commands I actually use, grouped by job. Use the variables input to swap placeholders like IMAGE_NAME or CONTAINER_NAME across every example.

Daemon and info

docker versionClient and engine versions
docker infoEngine status, storage driver, image/container counts, host info
docker context lsList docker contexts (default, desktop-linux, remote)
docker context use CONTEXT_NAMESwitch the active context
sudo systemctl status dockerLinux: is the daemon running
sudo systemctl start dockerLinux: start the daemon

Images

docker pull IMAGE_NAMEPull an image from the registry
docker imagesList images on this host
docker image ls -aList all images including intermediates
docker rmi IMAGE_NAMERemove an image
docker image pruneRemove dangling images (untagged)
docker image prune -aRemove all unused images, tagged or not
docker tag IMAGE_NAME REGISTRY/REPO:TAGTag an image for push
docker image inspect IMAGE_NAMEFull metadata, env, entrypoint, labels
docker image history IMAGE_NAMELayer history with sizes, audit what bloats the image
docker manifest inspect IMAGE_NAMEShow platforms an image supports (arm64, amd64)

Container lifecycle

docker run IMAGE_NAMEStart a container from an image
docker psList running containers
docker ps -aList all containers including stopped
docker stop CONTAINER_NAMESend SIGTERM then SIGKILL after 10s
docker start CONTAINER_NAMEStart a stopped container
docker restart CONTAINER_NAMEStop + start
docker kill CONTAINER_NAMESIGKILL immediately
docker pause CONTAINER_NAMEFreeze all processes with cgroups
docker unpause CONTAINER_NAMEResume a paused container
docker rm CONTAINER_NAMERemove a stopped container
docker rm -f CONTAINER_NAMEForce remove, stops first
docker container pruneRemove all stopped containers
docker rename OLD NEWRename a container

docker run, the flags worth knowing

docker run -d IMAGE_NAMEDetached / background
docker run -it IMAGE_NAME bashInteractive shell, allocate a TTY
docker run --rm IMAGE_NAMERemove container automatically when it exits
docker run --name CONTAINER_NAME IMAGE_NAMEName the container instead of getting a random one
docker run -p HOST_PORT:CONTAINER_PORT IMAGE_NAMEPublish a container port to the host
docker run -p 127.0.0.1:HOST_PORT:CONTAINER_PORT IMAGE_NAMEPublish on a specific host interface only (localhost-only)
docker run -v VOLUME_NAME:/path/in/container IMAGE_NAMENamed volume mount
docker run -v /host/path:/path/in/container IMAGE_NAMEBind mount a host path
docker run -v /host/path:/path/in/container:ro IMAGE_NAMERead-only bind mount
docker run -e KEY=VALUE IMAGE_NAMESingle env var
docker run --env-file .env IMAGE_NAMELoad env vars from a file
docker run --network NETWORK_NAME IMAGE_NAMEAttach to a user-defined network
docker run --restart unless-stopped IMAGE_NAMERestart on crash/host reboot, unless you stopped it manually
docker run --user 1000:1000 IMAGE_NAMERun as a specific UID:GID instead of root
docker run --memory 512m --cpus 0.5 IMAGE_NAMEResource limits
docker run --platform linux/amd64 IMAGE_NAMEForce the platform (Apple Silicon running x86 images)
docker run --hostname HOST IMAGE_NAMESet the container's hostname
docker run --workdir /app IMAGE_NAMESet the working directory inside the container
docker run --entrypoint sh IMAGE_NAMEOverride the image's ENTRYPOINT
docker run --add-host db:192.168.1.10 IMAGE_NAMEAdd a /etc/hosts entry inside the container

Exec, inspect, logs

docker exec -it CONTAINER_NAME bashShell into a running container
docker exec -it CONTAINER_NAME shUse sh when bash is not installed (alpine images)
docker exec -it --user root CONTAINER_NAME bashForce root for installing tools or fixing permissions
docker exec CONTAINER_NAME ls /appRun a single non-interactive command
docker logs CONTAINER_NAMEContainer output (stdout + stderr)
docker logs -f CONTAINER_NAMEFollow logs (tail -f)
docker logs --tail 100 CONTAINER_NAMELast 100 lines only
docker logs --since 10m CONTAINER_NAMELast 10 minutes
docker logs --since 2026-05-01 CONTAINER_NAMESince a specific date
docker logs --timestamps CONTAINER_NAMEPrepend ISO timestamps to each line
docker inspect CONTAINER_NAMEFull JSON: mounts, env, network IPs, state, exit codes
docker inspect --format '{{.State.Status}}' CONTAINER_NAMEPluck one field with a Go template
docker top CONTAINER_NAMEProcesses running inside the container
docker statsLive CPU, memory, network, disk per container
docker port CONTAINER_NAMEShow port mappings for one container
docker diff CONTAINER_NAMEFiles changed since the image was created
docker cp CONTAINER_NAME:/path /host/pathCopy a file out of a container
docker cp /host/file CONTAINER_NAME:/pathCopy a file into a container

Build

docker build -t IMAGE_NAME .Build from the Dockerfile in the current directory
docker build -t IMAGE_NAME -f path/to/Dockerfile .Use a Dockerfile somewhere other than ./Dockerfile
docker build --no-cache -t IMAGE_NAME .Force a full rebuild
docker build --build-arg KEY=VALUE -t IMAGE_NAME .Pass a build-time ARG
docker build --target STAGE -t IMAGE_NAME .Stop at a multi-stage target (e.g. build dev image from a 'dev' stage)
docker build --platform linux/amd64,linux/arm64 -t IMAGE_NAME .Build for multiple architectures (needs buildx)
docker buildx create --useCreate and switch to a buildx builder (multi-arch)
docker buildx build --platform linux/amd64,linux/arm64 --push -t IMAGE_NAME .Multi-arch build pushed to a registry as a manifest list
docker builder pruneClean the BuildKit cache (separate from docker system prune)

Networks

docker network lsList networks
docker network create NETWORK_NAMECreate a user-defined bridge (service-name DNS works on these)
docker network inspect NETWORK_NAMEShow subnet, gateway, connected containers
docker network connect NETWORK_NAME CONTAINER_NAMEAttach a running container to a network
docker network disconnect NETWORK_NAME CONTAINER_NAMEDetach
docker network rm NETWORK_NAMERemove an empty network
docker network pruneRemove all unused networks

Volumes

docker volume lsList named volumes
docker volume create VOLUME_NAMEPre-create a named volume
docker volume inspect VOLUME_NAMEDriver, mountpoint, labels
docker volume rm VOLUME_NAMERemove a volume (must not be in use)
docker volume pruneRemove all unused volumes (data loss potential)
docker run --rm -v VOLUME_NAME:/from -v $(pwd):/to alpine tar czf /to/backup.tar.gz -C /from .Back up a named volume to a tar.gz on the host
docker run --rm -v VOLUME_NAME:/to -v $(pwd):/from alpine tar xzf /from/backup.tar.gz -C /toRestore a named volume from a tar.gz

Docker Compose (V2: docker compose, no hyphen)

docker compose upStart the stack in the current directory's docker-compose.yml
docker compose up -dDetached
docker compose up --buildRebuild images before starting
docker compose downStop and remove containers + networks
docker compose down -vAlso remove named volumes (data loss)
docker compose psStack-scoped container list
docker compose logs -f SERVICE_NAMEFollow logs for one service
docker compose exec SERVICE_NAME bashShell into a Compose service
docker compose restart SERVICE_NAMERestart one service
docker compose build SERVICE_NAMEBuild just one service's image
docker compose pullPull image updates for every service
docker compose run --rm SERVICE_NAME COMMANDRun a one-off command in the service's image
docker compose configValidate and print the merged compose file
docker compose top SERVICE_NAMEProcesses in a Compose service

Registry, push, pull, login

docker login REGISTRYLogin to a registry (Docker Hub if no host given)
docker logout REGISTRYLogout
docker tag IMAGE_NAME REGISTRY/REPO:TAGTag for a registry before push
docker push REGISTRY/REPO:TAGPush to the registry
docker pull REGISTRY/REPO:TAGPull from a private registry

Cleanup and disk space

docker system dfDisk usage by images, containers, volumes, build cache
docker system pruneRemove stopped containers, unused networks, dangling images, build cache
docker system prune -aAlso remove ALL unused images (not just dangling)
docker system prune -a --volumesThe nuclear option: also wipes unused volumes (data loss)
docker builder pruneBuildKit cache only
docker image prune -aUnused images only
docker container pruneStopped containers only
docker network pruneUnused networks only
docker volume pruneUnused volumes only (data loss potential)

Events and debugging

docker eventsStream the daemon event log (container start/stop/oom etc.)
docker events --filter event=oomOnly OOM kills
docker container inspect --format '{{.State.ExitCode}}' CONTAINER_NAMEExit code of the last run
docker container inspect --format '{{.State.OOMKilled}}' CONTAINER_NAMEWas it OOM-killed (exit code 137)

Docker has a wide CLI surface but the part you actually use day to day is small. This is the working set I reach for: images, container lifecycle, run flags, exec and logs, build, networks, volumes, Compose, registry, and the prune commands that keep a host from filling up. Generic placeholders like IMAGE_NAME, CONTAINER_NAME, HOST_PORT, VOLUME_NAME are swappable from the input above the cheat sheet, so you can type IMAGE_NAME=postgres:16, HOST_PORT=5432 and every example below updates in place.

For the longer-form pieces (writing a Dockerfile, Compose, multi-stage builds, troubleshooting), see the linked articles in the What to do next section.

What to do next

For the longer-form pieces this cheat sheet references:

FAQ

docker --help lists every subcommand and flag. This page is the working set: the ones I actually reach for, with the flags that matter and short notes on the gotchas. You will look at --help a handful of times a year for the rare flags; this page is what you have open on the second monitor while you work.

It accepts a comma-separated list like IMAGE_NAME=postgres:16, CONTAINER_NAME=db, HOST_PORT=5432. Every occurrence of those tokens in the examples below the input is swapped on the fly. Useful when you want to copy commands without doing the mental find-replace.

Stored in your browser's localStorage, not on the server. Clear it with the button next to the input.

docker compose (space). Compose V2 has been the default since 2022, and the standalone docker-compose binary was removed from official packages mid-2024. The commands and the file format are otherwise the same; the version: key at the top of docker-compose.yml is no longer required and is warned-about in current Compose. See Docker Compose: Getting Started.

docker system prune sweeps stopped containers, unused networks, dangling images, and build cache in one pass. -a extends that to all unused images. --volumes extends it to unused volumes, that flag is the data-loss one. The individual docker image prune, docker container prune, docker volume prune, docker network prune, and docker builder prune let you scope the cleanup. Full breakdown in docker system prune: Free Disk Space.

You are running an x86 image under QEMU emulation. Use --platform linux/arm64 if the image publishes an arm64 manifest, or accept the emulation hit. docker manifest inspect IMAGE_NAME shows which platforms the image supports. The full story is in "exec format error", Apple Silicon and Multi-Architecture Docker Images.

Sources

Authoritative references this article was fact-checked against.

TagsDockerContainersDevOpsCLICheat SheetDocker ComposeBuildKit

Found this useful? Pass it on.

Copied

Ishan Karunaratne

Systems and Network Architect · Chief Technology Officer

Systems and network architect and Chief Technology Officer with more than two decades designing, building, and running production software, cloud and network architecture, Linux systems, and the bare metal underneath them, and lately working AI into the stack. A US Army veteran who served in Operation Iraqi Freedom. What I write here is drawn from the full arc of that work, across architecture, engineering, and operations, not any single job.

More by Ishan →LinkedIn
Keep reading

Related posts

Regex Cheat Sheet including regex symbols, ranges, grouping, assertions, syntax tables, examples, matches, and compatibility tables. Definitive Regular Expressions Quick Reference!
Regex

Regex Cheat Sheet

A regular expression is a pattern that describes a set of strings. This cheat sheet covers character classes, anchors, quantifiers, groups, lookarounds and flags, with per-engine compatibility tables.

Elasticsearch 9.x cheat sheet: index and document operations, Query DSL, aggregations, vector / kNN search, ESQL, cluster management, and common mistakes.
Database

Elasticsearch Cheat Sheet

Practitioner reference for Elasticsearch 9.x: index and document operations, Query DSL, aggregations, vector / kNN search, ESQL, cluster management, version compatibility notes, and the gotchas that bite first-time operators.

Open vintage hardcover reference manual on a dark slate desk, dense columned print on warm cream pages lit by a single warm amber side lamp
Database

MySQL Cheat Sheet

MySQL cheat sheet covering CLI commands, database and table operations, joins, indexes, backups, user management, and transactions, with version notes for 5.7, 8.0, and 8.4.