Docker CLI Cheatsheet - Command Reference

A Docker command reference for app developers and SREs, covering image build, container lifecycle, networks & volumes, Compose orchestration, and resource cleanup. Unlike OS-level container tools, Docker layered images and isolation are what matter when you must debug startup failures, mapping mistakes, or image bloat. By the end you can bring a service up from an image and troubleshoot the three most frequent problems: startup, networking, and disk usage.

Containers & Orchestration·52 commands·Last updated 2026-07-21

Image 8

docker images

List local images, add -a to include intermediate layers

docker pull nginx:alpine

Pull image with tag, defaults to latest if omitted

docker build -t app:1.0 .

Build and tag from Dockerfile in current dir

docker rmi <image>

Remove image, stop container first or use -f

docker tag app:1.0 reg/app:1.0

Tag image for registry push

docker save -o app.tar app:1.0

Export image as tar for offline transfer

docker load -i app.tar

Load image from tar file, useful in offline environments

docker pull alpine:3.20 --platform=linux/amd64

Pull image for a specific platform, e.g. amd64 on ARM Mac

Container 9

docker ps -a

List all containers including stopped

docker run -d -p 8080:80 --name web nginx

Run detached, map port, name container

docker exec -it web sh

Interactive shell into running container

docker logs -f --tail 100 web

Follow last 100 lines of container logs

docker stop web && docker rm web

Stop and remove container

docker inspect web

Full container config JSON for network/mount debugging

docker start web && docker restart web

Start or restart a stopped container

docker stats

Live CPU/memory/network I/O stats for all containers

docker top web

List running processes inside a container

Network & Volume 8

docker network ls

List networks, check here first for inter-container access

docker network create appnet

Create custom bridge network for name-based discovery

docker network connect appnet web

Connect a running container to a network

docker volume ls

List volumes

docker run -v data:/var/lib/app app

Mount named volume for persistence

docker run -v $(pwd):/app app

Bind mount current dir, common in dev

docker volume create appdata

Create a named volume for shared data

docker volume prune

Remove all unused volumes

Registry 6

docker login

docker login registry.example.com

docker push app:1.0

Push image to remote registry, must tag first

docker pull ubuntu:22.04

Pull Ubuntu 22.04 image from Docker Hub

docker search nginx

Search Docker Hub for official images

docker logout

Log out from the current registry

Build & Debug 7

docker build -t app:1.0 --no-cache .

Force rebuild without cache layers

docker build -t app:1.0 --target=dev .

Build only up to a specific multi-stage target

docker history app:1.0

View image build history, layer sizes and commands

docker diff <container>

Inspect filesystem changes in a container

docker cp app.conf web:/etc/nginx/conf.d/

Copy local config file into a container

docker cp web:/var/log/nginx/access.log ./

Copy a log file from a container to local

docker events --since 5m

Stream Docker daemon events in real time

Compose & Cleanup 9

docker compose up -d

Start Compose project in background

docker compose logs -f svc

Follow logs for a specific service

docker compose down

Stop and remove containers, networks; add -v for volumes

docker compose ps

List container status for all services in Compose project

docker compose restart

Restart all or specified services

docker system df

Check disk usage by images/containers/volumes

docker system prune -a

Clean all unused images and containers, use -a with caution

docker container prune

Remove all stopped containers

docker image prune -a

Remove all unused images to free disk space

FAQ 5

Q: How to clean up all unused Docker resources?

A: docker system prune -a removes all unused images, containers, networks, and build cache. Add --volumes to also remove volumes.

Q: How to view container logs?

A: docker logs <container> shows full logs, add -f to follow, --tail 50 for last 50 lines, --since 5m for last 5 minutes.

Q: How to enter a running container?

A: docker exec -it <container> /bin/bash (or /bin/sh). Exit with exit or Ctrl+D.

Q: How to copy files between host and container?

A: docker cp <src> <container>:<dest> to copy in, docker cp <container>:<src> <dest> to copy out.

Q: What restart policies are available?

A: --restart=no (default)/on-failure/always/unless-stopped. unless-stopped is common for production.

Typical Use Case

This works along two lines: local development and production deployment. Locally, use docker run to start a port-mapped dependency service (nginx, MySQL, Redis) quickly, or bind-mount the source directory for hot-reload debugging; use docker compose up -d to bring up a whole multi-service environment at once. In production, build and push to a private registry with docker build/push, then pull and run on the target host. When a service misbehaves, confirm the container is alive with docker ps, read app logs with docker logs, inspect network and mounts with docker inspect, and re-verify config with docker exec. On disk alarms or image accumulation, locate the usage with docker system df and clean up as needed with docker image prune.

Command Examples

Run nginx in the background with a port mapping

docker run -d --name web -p 8080:80 nginx:alpine

-p 8080:80 表示宿主机 8080 转发到容器 80，访问 http://localhost:8080 即可看到 nginx 欢迎页；-d 让容器后台运行，--name 便于后续用名字管理。

Output

b3f2c1a9d8e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b

Bind-mount the current directory and enter an interactive shell

docker run -it --rm -v "$(pwd)":/app -w /app node:18-alpine sh

-v 把当前目录挂载到容器 /app，-w 设为工作目录，--rm 退出时自动删除容器，-it 提供交互终端，适合本地调试 Node 应用而无需本地安装 Node。

Follow the last 100 lines of a container log

docker logs -f --tail 100 web

-f 实时跟踪后续日志，--tail 100 只从最后 100 行开始输出，排查启动崩溃或请求异常时第一命令。

Prune unused images to free disk space

docker system df

先 docker system df 看占用，再决定是否 docker image prune -a 清理所有未被容器引用的镜像；删镜像前务必确认没有需要保留的版本。

Output

TYPE            TOTAL     ACTIVE    SIZE      RECLAIMABLE
Images          12        5         1.4GB     621.5MB (43%)
Containers      8         3         5.6MB     5.6MB (100%)

Common Pitfalls

docker run -p is host_port:container_port — reversed means external access never works, and it fails silently, the hardest thing to debug.
prune -a removes every image no container is using, including freshly built but not-yet-run versions. Run docker images first on production.
An "executable file not found" error usually means the image lacks that shell; Alpine ships only sh, so use docker exec -it <c> sh.
Flags like -e env vars and port mappings cannot be changed after the container starts; you must stop, remove, and re-run.
A permission denied on bind mounts often comes from a mismatch between the host directory owner and the container user.

Tips

In docker run -p, it's host_port:container_port — reversing them blocks external access.
If exec says "executable file not found", switch to sh: Alpine images usually lack bash.
prune -a removes all images not used by any container — verify with docker images first on production.
docker system df quickly shows disk usage — run it periodically to avoid /var/lib/docker filling up.
docker compose restart is faster than down/up and does not rebuild networks or volumes — best for nginx config changes.

FAQ

What is the difference between docker run and docker start?

docker run creates and starts a new container from an image (first launch); docker start restarts an existing but stopped container without creating a new instance. Use start to debug existing state, run to deploy new services.

How do I free up disk space used by Docker?

Use docker system prune to remove stopped containers, dangling images, and build cache; add -a to also remove all images not referenced by any container. Use cautiously in production to avoid deleting valuable images.

What is the relationship between a container and an image?

An image is a read-only template containing the code, dependencies, and config needed to run an app; a container is a running instance of that image with a writable layer on top. One image can launch multiple isolated containers.

Why does my container exit immediately with status Exited (0)?

Check the exit code with docker ps -a: Exited (0) usually means the foreground process did not stay alive (the command finished and exited), so use -it or switch to a foreground command in the Dockerfile (e.g. CMD ["nginx","-g","daemon off;"]). For non-zero codes, run docker logs <id> to read the real error, usually a missing dependency, permission, or wrong config path.

Why can I not reach localhost from inside a container?

Inside a container, localhost refers to the container itself, not the host, so host services are unreachable via localhost. To reach a host service, use the default bridge gateway IP (host.docker.internal on macOS/Windows, --network host or the host LAN IP on Linux). To make containers talk to each other, join them to a custom network and address them by container name.

Official References

Each command links to its official documentation below, so you can verify the latest usage and read deeper.

Docker Docs

Maintained by LaoHand

Publicly updated on Jul 21, 2026, continuously proofread against official docs.

Contact Us

Wrong command or description? Send us corrections, business inquiries or product feedback by email.