🐋

Docker

Docker CLI, Dockerfile patterns, Compose, networking, volumes and registry operations

Images

Build, tag, inspect and clean up Docker images

bash·List images
docker images
bash·Build image from Dockerfile
docker build -t myapp:latest .
bash·Build with a specific Dockerfile
docker build -f docker/Dockerfile.prod -t myapp:prod .
bash·Build with build args
docker build --build-arg NODE_ENV=production --build-arg PORT=8080 -t myapp .
bash·Build for a specific platform
docker build --platform linux/amd64 -t myapp:amd64 .
bash·Build multi-platform and push
docker buildx build --platform linux/amd64,linux/arm64 -t myrepo/myapp:latest --push .
bash·Tag an image
docker tag myapp:latest myrepo/myapp:1.0.0
bash·Pull image
docker pull nginx:alpine
bash·Push image to registry
docker push myrepo/myapp:1.0.0
bash·Inspect image layers and metadata
docker inspect myapp:latest
bash·Show image layer history and sizes
docker history myapp:latest
bash·Remove image
docker rmi myapp:latest
bash·Remove all dangling images
docker image prune
bash·Remove all unused images
docker image prune -a
bash·Save image to tar file
docker save myapp:latest | gzip > myapp.tar.gz
bash·Load image from tar file
docker load < myapp.tar.gz

Containers

Run, stop, inspect and manage container lifecycles

bash·List running containers
docker ps
bash·List all containers (including stopped)
docker ps -a
bash·Run container (foreground)
docker run nginx:alpine
bash·Run container (detached + named)
docker run -d --name webserver nginx:alpine
bash·Run with port mapping
docker run -d -p 8080:80 nginx:alpine
bash·Run with environment variables
docker run -d -e NODE_ENV=production -e PORT=3000 myapp:latest
bash·Run with env file
docker run -d --env-file .env myapp:latest
bash·Run with volume mount
docker run -d -v $(pwd)/data:/app/data myapp:latest
bash·Run interactively and remove on exit
docker run -it --rm ubuntu:22.04 bash
bash·Run with resource limits
docker run -d --memory=512m --cpus=1.5 myapp:latest
bash·Run with restart policy
docker run -d --restart=unless-stopped myapp:latest
bash·Stop container
docker stop webserver
bash·Start stopped container
docker start webserver
bash·Restart container
docker restart webserver
bash·Remove container
docker rm webserver
bash·Stop and remove container
docker rm -f webserver
bash·Remove all stopped containers
docker container prune -f
bash·Stop all running containers
docker stop $(docker ps -q)

Logs, Exec & Inspect

Debug running containers — logs, shell access and low-level inspection

bash·Stream container logs
docker logs -f webserver
bash·Show last 100 lines with timestamps
docker logs --tail=100 --timestamps webserver
bash·Logs since a time
docker logs --since=1h webserver
bash·Execute command in running container
docker exec webserver cat /etc/nginx/nginx.conf
bash·Open interactive shell in container
docker exec -it webserver /bin/sh
bash·Open shell as root
docker exec -it -u root webserver /bin/bash
bash·Inspect container (full JSON metadata)
docker inspect webserver
bash·Get container IP address
docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' webserver
bash·Show live resource usage
docker stats
bash·Show resource usage (single, no stream)
docker stats webserver --no-stream
bash·Show running processes inside container
docker top webserver
bash·Copy file from container
docker cp webserver:/etc/nginx/nginx.conf ./nginx.conf
bash·Copy file into container
docker cp ./nginx.conf webserver:/etc/nginx/nginx.conf
bash·Diff filesystem changes vs image
docker diff webserver

Volumes

Create and manage named volumes for persistent data

bash·List volumes
docker volume ls
bash·Create named volume
docker volume create pgdata
bash·Inspect volume
docker volume inspect pgdata
bash·Mount named volume into container
docker run -d -v pgdata:/var/lib/postgresql/data postgres:16
bash·Bind mount current directory
docker run -d -v $(pwd):/app -w /app node:20 node index.js
bash·Read-only bind mount
docker run -d -v $(pwd)/config:/app/config:ro myapp
bash·Backup volume to tar
docker run --rm -v pgdata:/data -v $(pwd):/backup alpine tar czf /backup/pgdata.tar.gz -C /data .
bash·Restore volume from tar
docker run --rm -v pgdata:/data -v $(pwd):/backup alpine tar xzf /backup/pgdata.tar.gz -C /data
bash·Remove volume
docker volume rm pgdata
bash·Remove all unused volumes
docker volume prune -f

Networking

Create networks and connect containers together

bash·List networks
docker network ls
bash·Create bridge network
docker network create mynetwork
bash·Create network with subnet
docker network create --subnet=172.20.0.0/16 mynetwork
bash·Run container on specific network
docker run -d --network mynetwork --name api myapp:latest
bash·Connect running container to network
docker network connect mynetwork webserver
bash·Disconnect container from network
docker network disconnect mynetwork webserver
bash·Inspect network (see connected containers)
docker network inspect mynetwork
bash·Remove network
docker network rm mynetwork
bash·Remove all unused networks
docker network prune -f

Dockerfile Patterns

Production-ready Dockerfile patterns and best practices

docker·Node.js multi-stage production build
# ── deps stage ──────────────────────────────
FROM node:20-alpine AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev

# ── build stage ──────────────────────────────
FROM node:20-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# ── runtime stage ────────────────────────────
FROM node:20-alpine AS runtime
WORKDIR /app
ENV NODE_ENV=production

# Non-root user
RUN addgroup -S app && adduser -S app -G app
USER app

COPY --from=deps  /app/node_modules ./node_modules
COPY --from=build /app/dist         ./dist

EXPOSE 3000
CMD ["node", "dist/index.js"]
docker·Python multi-stage build
# ── build stage ──────────────────────────────
FROM python:3.12-slim AS build
WORKDIR /app

RUN pip install uv
COPY pyproject.toml uv.lock ./
RUN uv sync --frozen --no-dev --no-editable

# ── runtime stage ────────────────────────────
FROM python:3.12-slim AS runtime
WORKDIR /app
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

RUN addgroup --system app && adduser --system --ingroup app app
USER app

COPY --from=build /app/.venv ./.venv
COPY src/ ./src/

ENV PATH="/app/.venv/bin:$PATH"
EXPOSE 8000
CMD ["uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8000"]
docker·Go — single binary scratch image
# ── build stage ──────────────────────────────
FROM golang:1.23-alpine AS build
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o server ./cmd/server

# ── runtime stage (minimal) ──────────────────
FROM scratch
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=build /app/server /server
EXPOSE 8080
ENTRYPOINT ["/server"]
docker·Dockerfile best-practice patterns
# Pin base image versions for reproducibility
FROM node:20.18-alpine3.20

# Combine RUN layers to reduce image size
RUN apk add --no-cache curl git && \
    rm -rf /var/cache/apk/*

# Copy dependency manifests before source code
# (improves layer cache — only re-runs npm ci when lockfile changes)
COPY package*.json ./
RUN npm ci --omit=dev

COPY . .

# Use COPY instead of ADD unless you need auto-extraction
COPY config/ ./config/

# Prefer ENTRYPOINT + CMD for flexibility
ENTRYPOINT ["node"]
CMD ["dist/index.js"]

# HEALTHCHECK
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD curl -f http://localhost:3000/health || exit 1

# Document exposed ports and volumes
EXPOSE 3000
VOLUME ["/app/data"]

Docker Compose

Define and run multi-container applications

bash·Start services (detached)
docker compose up -d
bash·Start and rebuild images
docker compose up -d --build
bash·Start specific service
docker compose up -d api
bash·Stop services
docker compose down
bash·Stop and remove volumes
docker compose down -v
bash·Stream logs for all services
docker compose logs -f
bash·Stream logs for one service
docker compose logs -f api
bash·Scale a service
docker compose up -d --scale worker=5
bash·Run one-off command in service
docker compose run --rm api python manage.py migrate
bash·Exec into running service
docker compose exec api /bin/sh
bash·Restart a service
docker compose restart api
bash·Pull latest images for all services
docker compose pull
bash·Show running service status
docker compose ps
bash·Validate compose file
docker compose config
bash·Use alternate compose file
docker compose -f docker-compose.prod.yml up -d
yaml·Full compose.yml example
services:
  api:
    build:
      context: .
      dockerfile: Dockerfile
      target: runtime
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - DATABASE_URL=postgresql://user:pass@db:5432/app
    env_file:
      - .env
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    restart: unless-stopped
    networks:
      - backend

  db:
    image: postgres:16-alpine
    volumes:
      - pgdata:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: user
      POSTGRES_PASSWORD: pass
      POSTGRES_DB: app
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d app"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - backend

  redis:
    image: redis:7-alpine
    command: redis-server --save 60 1 --maxmemory 256mb --maxmemory-policy allkeys-lru
    volumes:
      - redisdata:/data
    networks:
      - backend

volumes:
  pgdata:
  redisdata:

networks:
  backend:
    driver: bridge

Registry & Security

Login to registries, scan images and manage credentials

bash·Login to Docker Hub
docker login
bash·Login to private registry
docker login registry.example.com
bash·Logout
docker logout
bash·Search Docker Hub
docker search nginx --limit 10
bash·Scan image for vulnerabilities (Scout)
docker scout cves myapp:latest
bash·Show Scout recommendations
docker scout recommendations myapp:latest
bash·Run as non-root (verify)
docker run --rm myapp:latest whoami
bash·Run read-only filesystem
docker run --read-only --tmpfs /tmp myapp:latest
bash·Drop all capabilities (least privilege)
docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE myapp:latest
bash·Run with security options
docker run --security-opt=no-new-privileges:true myapp:latest

System & Cleanup

Reclaim disk space and inspect Docker system usage

bash·Show disk usage by resource type
docker system df
bash·Show verbose disk usage
docker system df -v
bash·Remove all unused resources (safe prune)
docker system prune
bash·Remove everything including volumes
docker system prune -a --volumes
bash·Remove dangling images only
docker image prune -f
bash·Remove unused images (including tagged)
docker image prune -a -f
bash·Show Docker version info
docker version
bash·Show Docker system info
docker info
bash·Show all Docker events (live)
docker events
bash·Kill all running containers
docker kill $(docker ps -q)
bash·Remove all containers, images and volumes (nuclear)
docker stop $(docker ps -q) && docker system prune -a --volumes -f