Docker Cheatsheet

Images

docker build -t app:1.0 .    # build + tag
docker images                # list images
docker rmi app:1.0           # remove image
docker history app:1.0       # layers + sizes
docker tag app:1.0 reg/app:1.0
docker scout cves app:1.0    # scan for CVEs
docker system prune -af      # reclaim space

Containers

Run & Manage

docker run -d --name web -p 8080:3000 app:1.0
docker run -it --rm alpine sh   # interactive, auto-remove
docker ps        docker ps -a   # running / all
docker stop web  docker start web
docker rm web    docker rm -f web
docker restart web

Inspect & Debug

docker logs -f web           # follow logs
docker exec -it web sh       # shell inside
docker inspect web           # full JSON metadata
docker stats                 # live CPU/mem
docker cp web:/app/log.txt . # copy out

Common run Flags

Dockerfile

# syntax=docker/dockerfile:1
FROM node:22-alpine
WORKDIR /app
COPY package*.json ./     # deps first = better cache
RUN npm ci --omit=dev
COPY . .
ENV NODE_ENV=production
EXPOSE 3000
USER node
CMD ["node", "server.js"]

Multi-Stage

FROM golang:1.23 AS build
WORKDIR /src
COPY . .
RUN CGO_ENABLED=0 go build -o /bin/app .

FROM gcr.io/distroless/static-debian12
COPY --from=build /bin/app /app
ENTRYPOINT ["/app"]

Volumes & Networks

docker volume create pgdata
docker run -v pgdata:/var/lib/postgresql/data postgres:17
docker run -v "$(pwd)":/app -w /app node:22 npm run dev
docker volume ls    docker volume rm pgdata

docker network create appnet
docker run --network appnet --name db postgres:17
# other containers reach it by name "db"
docker network ls   docker network inspect appnet

Compose

# compose.yaml
services:
  api:
    build: .
    ports: ["8080:3000"]
    environment:
      DB_HOST: db
    depends_on: [db]
  db:
    image: postgres:17
    volumes: ["pgdata:/var/lib/postgresql/data"]
volumes:
  pgdata:

docker compose up -d        # build + start
docker compose ps           # status
docker compose logs -f api  # follow logs
docker compose exec db sh   # shell into service
docker compose down -v      # stop + remove + volumes

Registries & Buildx

docker login ghcr.io
docker tag app:1.0 ghcr.io/acme/app:1.0
docker push ghcr.io/acme/app:1.0
docker pull ghcr.io/acme/app:1.0

# multi-arch build + push
docker buildx build --platform linux/amd64,linux/arm64 \
  -t ghcr.io/acme/app:1.0 --push .

.dockerignore

node_modules
.git
.env
*.log
dist