Overview
This card lists the docker and docker compose commands used daily. Image definition (multi-stage builds, CMD, HEALTHCHECK) is in dockerfile-syntax; cluster-level commands are in kubernetes-commands. BuildKit is the default builder.
Build
Tag every build, and use --target to build one stage.
| Command | Effect |
|---|---|
docker build -t myapp:1.0 . | Build from ./Dockerfile and tag. |
docker build -f docker/prod.Dockerfile -t myapp:prod . | Non-default Dockerfile. |
docker build --target builder -t myapp:builder . | Stop at a named stage. |
docker build --build-arg NODE_ENV=production . | Build-time variable. |
docker build --secret id=npm,src=$HOME/.npmrc . | Mount a secret for a RUN --mount=type=secret step; it is not stored in a layer. |
docker build --no-cache . | Ignore the layer cache. |
docker image ls, docker image rm myapp:old | List local images / delete one. |
docker buildx build --platform linux/amd64,linux/arm64 -t myapp:1.0 --push . | Multi-platform build and push. |
Run
Set restart policy, limits, and environment at run time.
| Command | Effect |
|---|---|
docker run -d --name api -p 127.0.0.1:8080:8080 myapp | Detached, named, port bound to localhost only. |
docker run --rm -it myapp sh | Throwaway interactive shell. |
docker run --env-file .env myapp | Environment from a file (keep it out of git). |
docker run -v "$PWD/data:/app/data" myapp | Bind-mount a host directory. |
docker run -v appdata:/app/data myapp | Named volume. |
docker run --network mynet myapp | User-defined network. |
docker run --memory 512m --cpus 1 myapp | Resource limits. |
docker run --restart unless-stopped myapp | Restart unless you stopped it. |
Inspect
Read state with inspect and logs before restarting anything.
| Command | Effect |
|---|---|
docker ps -a | Running and stopped containers. |
docker logs -f --tail 100 api | Follow the last 100 log lines. |
docker exec -it api sh | Shell in a running container. |
docker inspect api --format '{{.State.Status}}' | One field via a Go template. |
docker stats --no-stream | CPU, memory, and I/O snapshot. |
docker top api | Processes inside the container. |
docker cp api:/app/log.txt . | Copy a file out. |
Compose
Use up -d --wait in scripts so they continue only when services are healthy.
| Command | Effect |
|---|---|
docker compose up -d --build | Build and start in the background. |
docker compose up -d --wait | Start and wait until services are healthy. |
docker compose logs -f --tail 100 web | Follow one service. |
docker compose exec web sh | Shell in a service. |
docker compose run --rm web <cmd> | One-off command in a new container. |
docker compose down -v | Stop and remove containers, networks, and named volumes. |
Networks, volumes, cleanup
Run docker system df before pruning, and prune volumes deliberately.
| Command | Effect |
|---|---|
docker network create mynet, docker network connect mynet api | Create; attach a running container. |
docker network ls, docker network inspect mynet | List; show connected containers and subnet. |
docker volume create pgdata, docker volume inspect pgdata | Create a named volume; show its mountpoint. |
docker volume ls, docker volume rm pgdata | List; delete (the data is gone). |
docker system df | See what is using disk before pruning. |
docker image prune -a, docker container prune | Remove unused images, stopped containers. |
docker volume prune -a | Remove all unused volumes, named included. |
docker system prune | Stopped containers, unused networks, dangling images, build cache. |
Gotchas
Avoid these; each exposes ports, loses data, or fills the disk.
| Gotcha | Fix |
|---|---|
-p 8080:8080 binds every host interface. | Bind 127.0.0.1:8080:8080 in development. |
docker system prune --volumes removes anonymous volumes only, so named volumes survive. | docker volume prune -a for named volumes; run docker system df first. |
COPY . . copies .env and .git. | Keep a .dockerignore. |
docker run without --rm leaves stopped containers. | Add --rm or run docker container prune. |
docker exec needs a shell in the image; distroless and scratch images have none. | Add a debug stage or run a separate debug container. |
| Bind mounts of large trees are slow on macOS and Windows. | Use named volumes for databases. |