DOCKER
CHEAT SHEET.

Docker Basics

Image Management

Basic Commands

# List images
docker images
docker image ls

# Pull image
docker pull nginx:latest
docker pull ubuntu:20.04

# Build image
docker build -t my-app:1.0 .
docker build -t my-app:latest -f Dockerfile.prod .

# Tag image
docker tag my-app:1.0 username/my-app:1.0

# Push to registry
docker push username/my-app:1.0

# Remove image
docker rmi image-id
docker rmi my-app:1.0
docker image prune       // remove unused images
docker image prune -a    // remove all unused images

# Inspect image
docker inspect image-id
docker history my-app:1.0

# Save / Load
docker save -o my-app.tar my-app:1.0
docker load -i my-app.tar

Container Management

Run Containers

# Run container (detached)
docker run -d --name my-nginx nginx

# Run with port mapping
docker run -d -p 8080:80 --name web nginx

# Run with environment variables
docker run -d -e MY_VAR=value --name app my-image

# Run interactively
docker run -it --name ubuntu ubuntu bash

# Run with volume
docker run -d -v /host/path:/container/path --name app my-image

# Run with resource limits
docker run -d --memory="512m" --cpus="1.0" --name app my-image

# Run with restart policy
docker run -d --restart=unless-stopped --name app my-image

# Run and auto-remove after exit
docker run --rm -it ubuntu bash

Container Operations

# List containers
docker ps                // running
docker ps -a             // all containers
docker ps -q             // only container IDs

# Start / Stop / Restart
docker start container-name
docker stop container-name
docker restart container-name

# Pause / Unpause
docker pause container-name
docker unpause container-name

# Remove container
docker rm container-name
docker rm -f container-name   // force remove running
docker container prune        // remove stopped containers

# Execute command in running container
docker exec -it container-name bash
docker exec container-name ls -la

# Attach to running container
docker attach container-name

# View logs
docker logs container-name
docker logs -f container-name   // follow
docker logs --tail 100 container-name

# Inspect
docker inspect container-name
docker stats container-name   // resource usage
docker top container-name     // processes

# Copy files
docker cp file.txt container-name:/path/
docker cp container-name:/path/file.txt ./

Dockerfile

Common Instructions

Example Dockerfile (Node.js)

// Multi‑stage build
# Stage 1: Build
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm install --production
COPY . .
RUN npm run build

# Stage 2: Production
FROM node:18-alpine
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
EXPOSE 3000
CMD ["node", "dist/server.js"]

// Minimal Node.js Dockerfile
FROM node:18-alpine
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
EXPOSE 3000
CMD ["npm", "start"]

Example Dockerfile (Python)

FROM python:3.11-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
EXPOSE 8000
CMD ["python", "app.py"]

Example Dockerfile (Nginx)

FROM nginx:alpine
COPY ./static /usr/share/nginx/html
COPY ./nginx.conf /etc/nginx/conf.d/default.conf
EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]

Docker Compose

docker-compose.yml Basic

version: '3.8'

services:
  web:
    build: .
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
    volumes:
      - ./data:/app/data
    depends_on:
      - db
      - redis

  db:
    image: postgres:15
    environment:
      POSTGRES_USER: user
      POSTGRES_PASSWORD: password
      POSTGRES_DB: myapp
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"

  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"

volumes:
  postgres_data:

docker-compose Commands

# Start services
docker-compose up
docker-compose up -d         // detached
docker-compose up -d --build  // rebuild and start

# Stop services
docker-compose down
docker-compose down -v       // remove volumes
docker-compose down --rmi all // remove images

# View logs
docker-compose logs
docker-compose logs -f       // follow
docker-compose logs web      // specific service

# Execute command
docker-compose exec web bash
docker-compose exec db psql -U user

# Run one‑off command
docker-compose run --rm web npm test

# Build images
docker-compose build
docker-compose build web     // specific service

# Pull images
docker-compose pull

# List services
docker-compose ps

# Restart service
docker-compose restart web

# View resource usage
docker-compose top

Volumes

# Create volume
docker volume create my-volume

# List volumes
docker volume ls

# Inspect volume
docker volume inspect my-volume

# Remove volume
docker volume rm my-volume
docker volume prune

Volume Usage

# Named volume
docker run -d -v my-volume:/data --name app my-image

# Bind mount
docker run -d -v /host/path:/container/path --name app my-image

// In docker-compose.yml
volumes:
  - my-volume:/app/data
  - ./local:/app/local

// Named volume declaration
volumes:
  my-volume:

Networks

# Create network
docker network create my-network

# List networks
docker network ls

# Inspect network
docker network inspect my-network

# Connect container
docker network connect my-network container-name

# Remove network
docker network rm my-network

Network Usage

# Create and run on network
docker run -d --network my-network --name web nginx
docker run -d --network my-network --name app my-image

// In docker-compose.yml
services:
  web:
    networks:
      - frontend
      - backend

networks:
  frontend:
  backend:

Container Networking

# Access from another container (by service name)
curl http://web:80

# Expose ports
docker run -d -p 8080:80 nginx
docker run -d -p 127.0.0.1:8080:80 nginx  // bind to localhost
docker run -d -p 8080-8085:80-85 nginx  // range

Container Registry

Docker Hub

# Login
docker login
docker login -u username

# Push / Pull
docker push username/repo:tag
docker pull username/repo:tag

# Search
docker search nginx

# Logout
docker logout

Private Registry

# Start registry
docker run -d -p 5000:5000 --name registry registry:2

# Tag and push
docker tag my-image localhost:5000/my-image
docker push localhost:5000/my-image

# Pull from private registry
docker pull localhost:5000/my-image

Docker System Management

# View system usage
docker system df

# Clean up unused resources
docker system prune
docker system prune -a -f   // all unused, force

# View events
docker system events

# View Docker info
docker info
docker version

Security Best Practices

• Avoid running as root – use USER instruction
• Use specific base images – alpine for smaller size
• Use .dockerignore – exclude secrets and build artifacts
• Scan images – docker scan image:tag
• Use secrets – Docker secrets (swarm) or environment variables
• Limit resource usage – memory and CPU limits
• Use read‑only root filesystem – --read-only
• Keep images up to date – frequently rebuild
• Use signed images – Docker Content Trust (DCT)
• Avoid storing secrets in images – use secrets management

.dockerignore Example

node_modules
.git
.env
*.log
*.tmp
.DS_Store
coverage
dist
build
.idea
.vscode

Docker Commands Quick Reference