Running, building, inspecting and cleaning up — plus the flags that keep a laptop from filling with dead layers.
run is create plus start. --rm on anything interactive, or you accumulate stopped containers forever.
| Command | What it does | Typical use |
|---|---|---|
| docker run --rm -it | Interactive, removed on exit | docker run --rm -it ubuntu bash |
| docker run -d --name | Detached, with a name you can refer to | docker run -d --name web nginx |
| docker run -p 8080:80 | Publish host:container. Add 127.0.0.1: to avoid exposing it | docker run -p 127.0.0.1:8080:80 nginx |
| docker run -v $PWD:/app:ro | Bind-mount, read-only | docker run -v $PWD:/app:ro node npm test |
| docker run -e / --env-file | Environment variables | docker run --env-file .env api |
| docker run --memory=512m --cpus=1.5 | Resource limits — the cgroup settings | docker run --memory=512m --cpus=1.5 api |
| docker run --init | Real init as PID 1 — reaps zombies, forwards signals | docker run --init api |
| docker run -u $(id -u):$(id -g) | Run as your UID so bind-mounted files aren't root-owned | docker run -u $(id -u):$(id -g) -v $PWD:/w node |
| docker run --read-only --tmpfs /tmp | Immutable root filesystem with writable /tmp | docker run --read-only --tmpfs /tmp api |
| docker run --restart=unless-stopped | Restart on failure and on boot, but honour a manual stop | docker run -d --restart=unless-stopped api |
| docker start / stop / restart | Lifecycle of an existing container | docker stop -t 30 web |
Layers are cached in order, so the least-changing steps go first. Copying source before installing dependencies invalidates the cache on every edit.
| Command | What it does | Typical use |
|---|---|---|
| docker build -t name:tag . | Build and tag | docker build -t api:v2 . |
| docker build --target | Stop at a named stage of a multi-stage build | docker build --target test -t api:test . |
| docker build --no-cache | Ignore the layer cache | docker build --no-cache -t api:v2 . |
| docker build --build-arg | Pass a build-time variable | docker build --build-arg VERSION=2.1 -t api . |
| docker build --platform linux/amd64 | Cross-build — routine on Apple silicon | docker build --platform linux/amd64 -t api . |
| docker buildx build --push --platform a,b | Multi-arch image, built and pushed in one step | docker buildx build --platform linux/amd64,linux/arm64 -t repo/api:v2 --push . |
| docker images --filter dangling=true | Untagged layers left by rebuilds | docker images --filter dangling=true |
| docker history | Every layer and what it cost — finds the fat one | docker history api:v2 |
| docker tag / docker push | Retag for a registry and upload | docker tag api:v2 repo/api:v2 && docker push repo/api:v2 |
| docker save / load | Move an image without a registry | docker save api:v2 | gzip > api.tgz |
inspect returns the full JSON; the -f Go template pulls out one value without piping through jq.
| Command | What it does | Typical use |
|---|---|---|
| docker ps -a | All containers, including stopped ones | docker ps -a |
| docker ps --filter status=exited | Filter by state, name, label or ancestor | docker ps --filter 'status=exited' |
| docker ps --format 'table {{.Names}}\t{{.Status}}' | Only the columns you want | docker ps --format 'table {{.Names}}\t{{.Status}}' |
| docker logs -f --tail 100 | Follow the last 100 lines | docker logs -f --tail 100 web |
| docker logs --since 10m -t | Time-bounded with timestamps | docker logs --since 10m -t web |
| docker inspect -f '{{.State.Pid}}' | One field out of the JSON | docker inspect -f '{{.State.Pid}}' web |
| docker inspect -f '{{.State.OOMKilled}}' | Was it killed for memory? | docker inspect -f '{{.State.OOMKilled}}' api |
| docker stats --no-stream | CPU, memory and I/O per container, once | docker stats --no-stream |
| docker exec -it | Shell in a running container | docker exec -it web sh |
| docker top | Processes inside a container, from the host's view | docker top web |
| docker diff | What changed in the container's filesystem since it started | docker diff web |
| docker cp | Copy files in or out — works on stopped containers too | docker cp web:/etc/nginx/nginx.conf . |
The default bridge has no DNS between containers. A user-defined network does, which is why compose creates one.
| Command | What it does | Typical use |
|---|---|---|
| docker network ls | Networks that exist | docker network ls |
| docker network create | A user-defined bridge — gives you container-name DNS | docker network create appnet |
| docker network connect | Attach a running container to another network | docker network connect appnet web |
| docker network inspect | Subnet, gateway and which containers are attached | docker network inspect appnet |
| docker run --network=host | Share the host's network namespace. Linux only | docker run --network=host api |
| docker volume create / ls | Named volumes — managed, unlike bind mounts | docker volume create pgdata |
| docker volume inspect | Where a volume actually lives on the host | docker volume inspect pgdata |
| docker run -v pgdata:/var/lib/postgresql/data | Mount a named volume | docker run -v pgdata:/var/lib/postgresql/data postgres |
| docker run --mount type=bind,src=,dst=,ro | Explicit form; fails loudly if the source is missing | docker run --mount type=bind,src=$PWD,dst=/app,ro node |
Compose v2 is docker compose — a subcommand, not the old docker-compose binary.
| Command | What it does | Typical use |
|---|---|---|
| docker compose up -d | Start the stack detached | docker compose up -d |
| docker compose up --build --force-recreate | Rebuild images and recreate containers | docker compose up -d --build |
| docker compose down -v | Stop and remove, including named volumes. Destroys data | docker compose down -v |
| docker compose logs -f svc | Follow one service | docker compose logs -f api |
| docker compose ps | Status of the stack's containers | docker compose ps |
| docker compose exec | Shell into a service by its compose name | docker compose exec db psql -U app |
| docker compose config | Render the final merged config — resolves every override and var | docker compose config |
| docker compose -f a.yml -f b.yml | Layer an override file over a base | docker compose -f compose.yml -f compose.prod.yml up -d |
| docker compose run --rm svc cmd | One-off command in a service's environment | docker compose run --rm api pytest |
Docker never reclaims anything on its own. On a build host this is the difference between a working disk and a 3am page.
| Command | What it does | Typical use |
|---|---|---|
| docker system df | What is using the space, by category | docker system df -v |
| docker system prune | Stopped containers, unused networks, dangling images, build cache | docker system prune |
| docker system prune -a --volumes | Everything not currently in use. Read that twice | docker system prune -a --volumes |
| docker image prune -a --filter 'until=168h' | Images unused for a week — a safe cron job | docker image prune -a --filter 'until=168h' -f |
| docker builder prune | Build cache only, leaving images alone | docker builder prune --keep-storage 10GB |
| docker volume prune | Volumes no container references. Check before running | docker volume ls -f dangling=true |
| docker container prune | Stopped containers only | docker container prune -f |
| docker rm -f $(docker ps -aq) | Remove every container, running or not | docker rm -f $(docker ps -aq) |