Docker & Docker Compose Cheat Sheet
Image = a blueprint. Container = a running instance of an image. Volume = persistent data. Compose = several containers defined in one YAML file.
On this page
Containers #
| Command | Action |
|---|---|
| Run in the background, host port 8080 → container port 80 | |
| Interactive shell in a new container | |
| Delete the container when it stops | |
| Set an environment variable | |
| Load variables from a file | |
| Mount a named volume | |
| Mount the current folder (bind mount) | |
| Restart automatically | |
| / | Running / all containers |
| / | Stop / start |
| Restart | |
| / | Remove / force-remove a running one |
| Open a shell in a running container | |
| Follow logs | |
| Copy a file out (or in) | |
| Live CPU / RAM per container | |
| All details (IP, mounts, env) |
Images #
| Command | Action |
|---|---|
| List images | |
| Download an image | |
| Build from the Dockerfile in this folder | |
| Use a different Dockerfile | |
| Tag for a registry | |
| Upload to a registry | |
| Remove an image | |
| Layers and their sizes |
Volumes & Networks #
| Command | Action |
|---|---|
| List volumes | |
| Create | |
| Remove (the data is gone!) | |
| List networks | |
| Create a network | |
Containers on the same network reach each other by name (http://api:3000) |
Cleanup #
| Command | Action |
|---|---|
| Remove stopped containers | |
| Remove dangling images | |
| Remove all unused images | |
Remove everything unused (add --volumes for volumes, careful) | |
| Disk usage |
Docker Compose #
| Command | Action |
|---|---|
| Start all services in the background | |
| Rebuild images, then start | |
| Stop and remove containers + network | |
| …also remove volumes (deletes data!) | |
| Service status | |
| Follow the logs of one service | |
| Shell into a service | |
| Restart one service | |
| Pull newer images | |
| Show the final merged config |
Example Dockerfile (Node) #
FROM node:22-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev
COPY . .
EXPOSE 3000
CMD ["node", "server.js"]Add a .dockerignore with node_modules, .git and .env.
Example compose.yaml #
services:
api:
build: .
ports:
- "3000:3000"
env_file: .env
depends_on:
- db
db:
image: mongo:7
volumes:
- dbdata:/data/db
volumes:
dbdata:Tips #
localhostinside a container is the container itself. Use the service name (db) to reach another container.- On Windows/macOS,
host.docker.internalreaches your host machine.
docker runCreate and start a container from an image. docker run [options] image [command]
| Option | What it does |
|---|---|
-d | Detached: run in the background |
-it | Interactive with a terminal (-it ubuntu bash) |
--name web | Give the container a name |
-p 8080:80 | Publish a port: host 8080 → container 80 (127.0.0.1:8080:80 = local only) |
-P | Publish all exposed ports to random host ports |
-e KEY=value | Environment variable |
--env-file .env | Variables from a file |
-v name:/data | Named volume |
-v "$(pwd)":/app | Bind-mount a folder (:ro = read-only) |
--mount type=bind,src=…,dst=… | Long form of -v |
--rm | Remove the container when it stops |
--restart unless-stopped | Restart policy (no, on-failure, always) |
--network mynet | Join a network |
-w /app | Working folder inside the container |
-u 1000:1000 | Run as a user |
--entrypoint sh | Override the entrypoint |
--memory 512m / --cpus 1.5 | Resource limits |
--gpus all | Give access to GPUs |
--platform linux/amd64 | Run an image for another CPU architecture |
-h name / --add-host db:10.0.0.5 | Hostname / extra /etc/hosts entry |
--init | Tiny init process (handles signals and zombies) |
--read-only | Read-only root filesystem |
docker psList containers. docker ps [options]
| Option | What it does |
|---|---|
| (none) | Running containers |
-a | Also stopped ones |
-q | Only IDs (docker rm $(docker ps -aq)) |
-l / -n 3 | The latest / last 3 created |
-s | Show disk size |
-f status=exited | Filter (name=web, ancestor=nginx, label=…) |
--format "table {{.Names}}\t{{.Status}}" | Custom columns |
--no-trunc | Don't shorten IDs and commands |
docker stopalso: docker start docker restartStop, start or restart containers. docker stop [options] container…
| Usage / option | What it does |
|---|---|
docker stop web | Graceful stop (SIGTERM, then SIGKILL after 10 s) |
-t 30 | Wait 30 seconds before killing (stop / restart) |
docker start web | Start a stopped container |
docker start -ai web | Start and attach interactively |
docker restart web | Stop + start |
docker kill web | Kill immediately (-s HUP sends another signal) |
docker stop $(docker ps -q) | Stop every running container |
docker rmRemove containers. docker rm [options] container…
| Option | What it does |
|---|---|
-f | Force: stop and remove a running container |
-v | Also remove its anonymous volumes |
$(docker ps -aq -f status=exited) | Every stopped container (or use docker container prune) |
docker execRun a command inside a running container. docker exec [options] container command
| Option | What it does |
|---|---|
-it web sh | Interactive shell (bash if the image has it) |
-u root | Run as another user |
-w /app | Working folder |
-e KEY=value | Extra environment variable |
-d | Run in the background |
--privileged | Extended privileges |
docker logsShow a container's output. docker logs [options] container
| Option | What it does |
|---|---|
-f | Follow live |
--tail 100 | Last 100 lines |
-t | Show timestamps |
--since 10m / --until | Time range (2026-10-01T08:00:00) |
--details | Extra details |
docker cpCopy files between a container and your computer. docker cp source destination
| Usage / option | What it does |
|---|---|
docker cp web:/etc/nginx/nginx.conf . | Out of the container |
docker cp ./site web:/usr/share/nginx/html | Into the container |
-a | Keep owner and group |
-L | Follow symbolic links |
docker statsLive CPU, memory, network and disk use per container. docker stats [options] [container…]
| Option | What it does |
|---|---|
-a | Include stopped containers |
--no-stream | One snapshot, then exit |
--format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}" | Custom columns |
--no-trunc | Full IDs |
docker inspectLow-level details as JSON (IP, mounts, env, config). docker inspect [options] name…
| Option | What it does |
|---|---|
-f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' | Pick one value: the IP (Go template) |
-f '{{json .Mounts}}' | One section as JSON |
--type image | Inspect an image / volume / network with the same name |
-s | Include sizes (containers) |
docker imagesList images. docker images [options] [repository]
| Option | What it does |
|---|---|
-a | Include intermediate and untagged (dangling) images |
-q | Only IDs |
-f dangling=true | Untagged leftovers (reference=node*, before=…) |
--digests | Show digests |
--format "{{.Repository}}:{{.Tag}} {{.Size}}" | Custom output |
--no-trunc | Full IDs |
Same as docker image ls.
docker pullDownload an image. docker pull [options] name[:tag]
| Option | What it does |
|---|---|
node:22-alpine | A specific tag (default latest) |
-a | All tags of the repository |
--platform linux/arm64 | Image for another architecture |
-q | Quiet |
name@sha256:… | Exact version by digest |
docker buildBuild an image from a Dockerfile. docker build [options] context
| Option | What it does |
|---|---|
-t myapp:1.0 | Name and tag (repeat -t for more tags) |
-f Dockerfile.prod | Use another Dockerfile |
. | Build context: the folder sent to the builder |
--build-arg KEY=value | Value for an ARG |
--target build | Stop at a stage of a multi-stage build |
--no-cache | Rebuild every step |
--pull | Always pull newer base images |
--platform linux/amd64,linux/arm64 | Multi-architecture build (docker buildx) |
--progress plain | Full build output |
--secret id=npm,src=.npmrc | Secrets that don't end up in the image |
-o out/ (--output) | Export files instead of an image |
--load / --push | Load into Docker / push to the registry (buildx) |
docker tagGive an image another name (for a registry). docker tag source target
| Usage | What it does |
|---|---|
docker tag myapp milan/myapp:1.0 | Docker Hub name |
docker tag myapp ghcr.io/milan/myapp:latest | GitHub Container Registry |
docker tag myapp registry.example.com:5000/myapp | Private registry |
docker pushUpload an image to a registry (docker login first). docker push [options] name[:tag]
| Option | What it does |
|---|---|
milan/myapp:1.0 | Push one tag |
-a (--all-tags) | Push every tag of the repository |
-q | Quiet |
docker login ghcr.io | Log in to another registry first |
docker rmiRemove images. docker rmi [options] image…
| Option | What it does |
|---|---|
-f | Force (also when containers use it, or several tags) |
--no-prune | Keep untagged parent images |
$(docker images -q -f dangling=true) | All dangling images (or docker image prune) |
docker historyLayers of an image and their sizes. docker history [options] image
| Option | What it does |
|---|---|
--no-trunc | Full commands |
-H=false | Exact sizes in bytes |
-q | Only layer IDs |
--format "{{.Size}}\t{{.CreatedBy}}" | Custom output |
docker volumeManage volumes (persistent data). docker volume command
| Command / option | What it does |
|---|---|
ls | List volumes (-f dangling=true = unused) |
create name | Create a volume |
inspect name | Details, including the folder on the host |
rm name | ⚠ Remove a volume and its data |
prune | Remove unused anonymous volumes (-a = all unused) |
docker networkManage networks. docker network command
| Command / option | What it does |
|---|---|
ls | List networks |
create mynet | New bridge network (--driver, --subnet 172.30.0.0/16) |
connect mynet web | Add a running container |
disconnect mynet web | Remove it |
inspect mynet | Details and connected containers |
rm mynet / prune | Remove one / all unused networks |
Containers on the same user-defined network reach each other by name.
docker containerContainer management commands. docker container command
| Command / option | What it does |
|---|---|
prune | Remove all stopped containers (-f = no question) |
prune --filter "until=24h" | Only older than 24 hours |
ls -a | Same as docker ps -a |
top web | Processes inside a container |
port web | Port mappings |
diff web | Files changed inside the container |
rename old new | Rename |
update --restart always web | Change settings of a container |
docker imageImage management commands. docker image command
| Command / option | What it does |
|---|---|
prune | Remove dangling (untagged) images |
prune -a | Remove every image no container uses |
prune --filter "until=168h" | Only older than a week |
ls | Same as docker images |
inspect / history | Details / layers |
save -o img.tar name / load -i img.tar | Export / import an image as a file |
docker systemWhole-system information and cleanup. docker system command
| Command / option | What it does |
|---|---|
df | Disk usage of images, containers, volumes, cache (-v = per item) |
prune | Remove stopped containers, unused networks, dangling images, build cache |
prune -a | Also every unused image |
prune --volumes | ⚠ Also unused volumes (data!) |
prune -f | Don't ask |
info | Docker version, storage driver, number of containers |
events | Live stream of Docker events |
docker composeRun multi-container apps defined in compose.yaml. docker compose [options] command
| Command / option | What it does |
|---|---|
up | Create and start everything (-d = in the background) |
up -d --build | Rebuild images first |
up --force-recreate | Recreate containers even if nothing changed |
up api | Only one service (and what it depends on) |
down | Stop and remove containers and networks |
down -v | ⚠ Also remove volumes |
down --rmi all | Also remove the images |
ps | Status of the services (-a all) |
logs -f api | Follow the logs of a service (--tail 100) |
exec api sh | Shell in a running service |
run --rm api npm test | One-off command in a new container |
restart api / stop / start | Control services |
pull | Pull newer images |
build | Build images (--no-cache) |
config | Show the final merged configuration |
watch | Sync / rebuild on file changes (develop section) |
-f compose.prod.yaml | Use another file (repeat to merge files) |
-p myproject | Project name |
--profile debug | Enable optional services |
--env-file .env.prod | Variables file |
Nothing on this sheet matches “”.