Docker Cheat Sheet

Downloads an image from a registry — Docker Hub by default — without running it.

Lists every image currently stored locally, with repository, tag, and size.

Creates and starts a new container from an image. On its own it's rarely useful — combine it with the flags in the next section.

docker ps lists running containers. Add -a to list every container, including ones that have already stopped.

Gracefully stops a running container — sends SIGTERM, waits briefly, then sends SIGKILL if it hasn't exited yet.

Removes a stopped container. Add -f to force-remove one that's still running, skipping the stop step.

Removes a local image. Fails if any container — even a stopped one — still references it; remove that container first.

-d runs the container detached, in the background, printing just its container ID instead of attaching your terminal to it.

-it allocates an interactive terminal (-t) and keeps stdin open (-i) — the combination you want for actually working inside a container's shell.

Gives the container a memorable name instead of a random one, so future stop/logs/exec commands can reference it by name instead of an ID.

Maps port 8080 on your machine to port 80 inside the container, always in host:container order.

Mounts a directory into the container, so files persist and are visible on both sides — see Volumes & Bind Mounts below for the full picture.

Automatically removes the container the moment it exits — ideal for one-off, throwaway commands so stopped containers don't quietly pile up.

Sets an environment variable inside the container. Repeat -e for each additional variable.

The base image every Dockerfile starts from. Pick the smallest base that has what you actually need — alpine variants are dramatically smaller than full Debian/Ubuntu bases.

Sets the working directory for every instruction after it — RUN, COPY, and CMD all execute relative to this path.

Copies files from your build context — the folder you ran docker build in — into the image, at the path set by WORKDIR.

Executes a command at build time and bakes its result into a new image layer, permanently, as part of the image.

Sets an environment variable that persists into every container run from this image — not just during the build, unlike a plain shell variable.

Documents which port the container listens on. Purely informational — it doesn't actually publish the port. That's still -p at run time.

The default command a container runs when started, unless overridden by whatever command you pass to docker run.

Builds an image from the Dockerfile in the current directory — the . is the build context — and tags it my-app:latest.

Adds another tag to an existing local image, typically to prepare it for pushing to a specific registry under a specific name.

Uploads a tagged image to a registry — Docker Hub, or a private one your team runs.

Authenticates with a registry before you're able to push to it.

Rebuilds every layer from scratch, ignoring Docker's build cache entirely — use when you suspect a cached layer has gone stale.

Creates a named volume, managed entirely by Docker, independent of any specific host path.

Mounts a named volume into a container — the data persists even after the container is removed, and other containers can reuse the same volume.

A bind mount: maps a specific host directory directly into the container, so edits on either side show up on both immediately — the standard setup for local development.

Lists every volume Docker currently knows about.

Deletes a named volume and everything stored inside it, permanently.

Lists Docker's networks. Every container joins the default bridge network unless told otherwise.

Creates a custom network, letting containers attached to it resolve each other by container name instead of by IP address.

Attaches a container to a specific network. Combine with --name so other containers on the same network can reach it by that name.

Shows which host ports are currently mapped to which ports inside a container — a quick sanity check when you've forgotten exactly what you mapped.

Starts every service defined in docker-compose.yml, detached in the background.

Stops and removes every container and network created by the compose file. Named volumes are kept unless you add --volumes.

Follows the combined logs of every service live, each line prefixed by which service it came from.

Opens a shell inside a running service's container, referenced by its service name from the compose file instead of a container ID.

Rebuilds images for any service that has a build: section in the compose file, without starting them.

Lists the containers managed by this compose file and their current status.

Shows a container's stdout/stderr output since it started. -f follows it live, the same idea as tail -f on a log file.

Opens an interactive shell inside an already-running container — the main way to poke around inside one without stopping it.

Dumps a container's full configuration as JSON — its IP address, mounted volumes, environment variables, network settings, all of it. The 'give me everything' command when higher-level commands don't show what you need.

A live, top-like view of every running container's CPU, memory, and network usage at once.

Lists the actual processes running inside a container, from the host's perspective.

Shows how much disk space images, containers, and volumes are using — the Docker equivalent of df -h, and worth checking before reaching for prune.

Removes all stopped containers, unused networks, dangling images, and build cache in one command. Prompts for confirmation first.

The same as above, but also removes every image not currently used by a running container — not just dangling ones. Considerably more aggressive.

Removes only dangling images — untagged layers left behind by rebuilds — without touching containers or networks at all.

Removes every stopped container in one pass.

Removes every volume not currently referenced by at least one container.