Docker command cheat sheet

System and version

docker --version

Print the client version only. Fast, and works even when the daemon is down.

Full guide
bash Example session
```
$docker --versionDocker version 29.7.2, build a7dcaa6
```
docker version --format '{{.Server.Version}}'

Ask the daemon its version. Fails if the daemon is unreachable, which makes it a liveness check.

Full guide
bash Example session
```
$docker version --format "Client {{.Client.Version}} / Server {{.Server.Version}} / API {{.Server.APIVersion}}"Client 29.7.2 / Server 29.7.2 / API 1.55
```
systemctl is-active docker

Confirm the daemon is running under systemd.

Full guide
bash Example session
```
$systemctl is-active dockeractive
```

docker info

Storage driver, cgroup version, root directory and resource totals for the whole engine.

Full guide

bash Example session

$docker info --format "Containers: {{.Containers}}  Images: {{.Images}}  Storage: {{.Driver}}  Cgroup: {{.CgroupVersion}}"Containers: 0  Images: 3  Storage: overlayfs  Cgroup: 2

docker system df

Disk used by images, containers, volumes and build cache, with how much is reclaimable.

bash Example session

$docker system dfTYPE            TOTAL     ACTIVE    SIZE      RECLAIMABLEImages          7         0         337.7MB   324.7MB (96%)Containers      0         0         0B        0BLocal Volumes   0         0         0B        0BBuild Cache     8         0         20.52MB   7.772MB

Images

docker pull IMAGE:TAG

Download an image before you need it. Prints the digest that identifies it exactly.

Full guide

bash Example session

$docker pull alpine:3.223.22: Pulling from library/alpineDigest: sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dceStatus: Downloaded newer image for alpine:3.22

docker images

List local images with their IDs and on-disk sizes.

Full guide

bash Example session

$docker image ls --format "table {{.Repository}}:{{.Tag}}\t{{.ID}}\t{{.Size}}"REPOSITORY:TAG       IMAGE ID       SIZEnginx:alpine         db35bfc6b295   94.2MBalpine:latest        28bd5fe8b56d   13MB

docker tag SRC TARGET

Add a second name for an image. Copies nothing and succeeds silently.

Full guide

bash Example session

$docker tag alpine:3.22 cg-mine:v1$docker images --filter reference=cg-mine --format "table {{.Repository}}:{{.Tag}}\t{{.ID}}\t{{.Size}}"REPOSITORY:TAG   IMAGE ID       SIZEcg-mine:v1       14358309a308   12.8MB

docker history IMAGE

Show each layer and what it cost. The fastest way to find why an image is large.

Full guide

bash Example session

$docker history cg-hello:1.0 --format "table {{.CreatedBy}}\t{{.Size}}"CREATED BY                                      SIZERUN /bin/sh -c apk add --no-cache curl # bui…   5.27MBADD alpine-minirootfs-3.22.5-x86_64.tar.gz /…   8.96MB

docker rmi IMAGE Destructive

Remove a tag. Layers survive while any other tag still references them.

Full guide
bash Example session
```
# removes the tag; deletes layers when the last reference goes$docker rmi cg-mine:v1Untagged: cg-mine:v1
```

Containers

docker run -d --name NAME -p HOST:CTR IMAGE

Start a detached container with a stable name and a published port.

Full guide
bash Example session
```
$docker run -d --name cg-web -p 8080:80 nginx:alpinee7cca8cbc07d53df511ddca22b6a143f300148e6937875be0ccae52f429f580c
```

docker ps

List running containers. Add -a to include stopped ones.

Full guide

bash Example session

$docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}"NAMES     IMAGE          STATUS                  PORTScg-web    nginx:alpine   Up Less than a second   0.0.0.0:8080->80/tcp, [::]:8080->80/tcp

docker stop | start | restart NAME

Lifecycle control. Stop sends SIGTERM first; the container and its filesystem survive.

Full guide
bash Example session
```
$docker stop cg-webcg-web$docker ps -a --format "{{.Names}} {{.Status}}"cg-web Exited (0) Less than a second ago
```

docker rm -f NAME Destructive

Stop and remove in one step. The writable layer is destroyed with it.

Full guide

bash Example session

# permanent - anything not in a volume is lost$docker rm cg-webError response from daemon: cannot remove container "cg-web": container is running: stop the container before removing or force remove$docker rm -f cg-webcg-web

docker rename OLD NEW

Change a container's name without recreating it. Succeeds silently.

Full guide
bash Example session
```
$docker rename cg-box cg-box2$docker ps --filter name=cg- --format "{{.Names}} {{.Status}}"cg-box2 Up Less than a second
```
docker diff NAME

Show what changed in the container's filesystem since it started. A for added, C changed, D deleted.
bash Example session
```
$docker exec cg-d sh -c "echo x > /newfile"$docker diff cg-dA /newfile
```

Logs and inspection

docker logs --tail N --timestamps NAME

Read stdout and stderr. Add -f to follow live.

Full guide

bash Example session

$docker logs --tail 3 --timestamps cg-web2026-08-20T05:22:55.324669532Z 2026/08/20 05:22:55 [notice] 1#1: start worker process 302026-08-20T05:22:55.357433243Z 172.17.0.1 - - [20/Aug/2026:05:22:55 +0000] "GET / HTTP/1.1" 200 896 "-" "curl/8.18.0" "-"

docker inspect --format '...' NAME

Pull single fields out of the full JSON record. Works on containers, images, networks and volumes.

Full guide
bash Example session
```
$docker inspect cg-web --format "{{.State.Status}} started={{.State.StartedAt}} restarts={{.RestartCount}}"running started=2026-08-20T05:22:55.200044778Z restarts=0
```

docker top NAME

Processes inside the container, with host PIDs and the user each runs as.

Full guide

bash Example session

$docker top cg-webUID     PID    PPID   C   STIME   TTY   TIME       CMDroot    3633   3610   0   05:22   ?     00:00:00   nginx: master process nginx -g daemon off;

docker stats --no-stream

One sample of CPU, memory and network per container. Without --no-stream it streams forever.

Full guide

bash Example session

$docker stats --no-stream --format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.NetIO}}" cg-webNAME      CPU %     MEM USAGE / LIMIT     NET I/Ocg-web    0.00%     10.78MiB / 3.319GiB   1.51kB / 1.68kB

Execution

docker exec NAME COMMAND

Run a command inside a running container without restarting it.

Full guide
bash Example session
```
$docker exec cg-web nginx -vnginx version: nginx/1.31.4
```
docker exec -it NAME sh

Interactive shell inside a running container. Use bash where the image has it.

Full guide
docker cp NAME:/path ./local

Copy files either direction. Works on stopped containers, which is how you retrieve a crash log.

Full guide
bash Example session
```
$docker cp cg-box2:/tmp/f.txt /tmp/cg-copied.txt && cat /tmp/cg-copied.txtwritten-inside
```

Ports and networking

docker port NAME

Show published port mappings without parsing inspect output.

Full guide
bash Example session
```
$docker port cg-web80/tcp -> 0.0.0.0:808080/tcp -> [::]:8080
```
docker network create NAME

Create a user-defined bridge. Unlike the default bridge, it gives containers DNS by name.

Full guide
bash Example session
```
$docker network create cg-net$docker exec cg-a ping -c1 -W2 cg-b64 bytes from 172.19.0.3: seq=0 ttl=64 time=0.596 ms
```

docker network ls

List networks and their drivers.

Full guide

bash Example session

$docker network lsNETWORK ID     NAME              DRIVER    SCOPE0feece5f4df1   bridge            bridge    local10048ac8b69a   host              host      local

docker network inspect NAME

Subnet, driver and every attached container with its address.

Full guide
bash Example session
```
$docker network inspect cg-net --format "{{range .Containers}}{{.Name}}={{.IPv4Address}} {{end}}"cg-a=172.19.0.2/16 cg-b=172.19.0.3/16
```

Volumes

docker volume create NAME

Create storage Docker manages, addressed by name rather than host path.

Full guide
bash Example session
```
$docker volume create cg-datacg-data$docker volume ls --filter name=cg-DRIVER    VOLUME NAMElocal     cg-data
```

docker run -v NAME:/path IMAGE

Mount a named volume. Data survives the container being removed.

Full guide

bash Example session

$docker run --rm -v cg-data:/data alpine sh -c "echo hello-from-volume > /data/note.txt; ls -l /data"$docker run --rm -v cg-data:/data alpine cat /data/note.txthello-from-volume

docker run -v /host:/ctr:ro IMAGE

Bind-mount a host directory read-only. The kernel enforces it.

Full guide
bash Example session
```
$docker exec cg-bind sh -c "touch /usr/share/nginx/html/x"touch: /usr/share/nginx/html/x: Read-only file system
```
docker volume rm NAME Destructive

Delete a volume and everything in it. No prompt, no undo.

Full guide
bash Example session
```
# DELETES THE DATA. There is no confirmation and no recovery.$docker volume rm cg-datacg-data
```

Dockerfile builds

docker build -t NAME:TAG .

Build an image from the Dockerfile in the current directory.

Full guide

bash Example session

$cd /tmp/cg-build && docker build -t cg-hello:1.0 .#6 [2/5] RUN apk add --no-cache curl#6 1.357 OK: 12 MiB in 25 packages#10 naming to docker.io/library/cg-hello:1.0 done#10 DONE 0.6s

docker build --progress=plain .

Full unfolded build log. Use when you need to see why a layer rebuilt.

Full guide
docker build --no-cache .

Ignore the cache and rebuild every layer. Slow by design - use to prove a build is reproducible.

Full guide

Compose

docker compose up -d

Create the network and start every service defined in compose.yaml.
bash Example session
```
$docker compose up -d Network cg-comp_default  Created Container cg-comp-web-1  Creating Container cg-comp-web-1  Started
```

docker compose ps

Status of the services in this project only, rather than every container on the host.

bash Example session

$docker compose psNAME            IMAGE          SERVICE   STATUS                  PORTScg-comp-web-1   nginx:alpine   web       Up Less than a second   0.0.0.0:8082->80/tcp

docker compose logs --tail N

Logs from every service, prefixed with the service name.

bash Example session

$docker compose logs --tail 2web-1  | 2026/08/20 06:05:18 [notice] 1#1: start worker process 30web-1  | 2026/08/20 06:05:18 [notice] 1#1: start worker process 31

docker compose down Caution

Stop and remove the project's containers and network. Named volumes are kept unless you add -v.
bash Example session
```
# removes containers and the project network; add -v and it removes volumes too$docker compose down Container cg-comp-web-1  Removed Network cg-comp_default  Removed
```

Registry

docker login REGISTRY

Authenticate to a registry. Credentials are stored by the configured credential helper.
docker push NAME:TAG

Upload an image. The repository name must match the registry and namespace you are pushing to.
docker image inspect IMG --format '{{index .RepoDigests 0}}'

Get the immutable digest so you can pin a build rather than trusting a mutable tag.

Full guide
bash Example session
```
$docker image inspect alpine:3.22 --format "{{index .RepoDigests 0}}"alpine@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce
```

Cleanup

docker system df

Check what is actually using disk before removing anything.

bash Example session

$docker system dfTYPE            TOTAL     ACTIVE    SIZE      RECLAIMABLEImages          7         0         337.7MB   324.7MB (96%)

docker rm -f NAME Destructive

Remove a specific container. Prefer naming things over blanket removal.
docker system prune Whole-host

Remove all stopped containers, unused networks, dangling images and build cache.

Not demonstrated here. This was deliberately never executed while writing these guides - it removes resources across the whole host, including work unrelated to what you are doing. Read `docker system df` first, remove named resources second, and reach for prune only when you understand exactly what it will take.

Troubleshooting

curl -s -o /dev/null -w "%{http_code}" URL

Prove a published port actually answers. Up in docker ps does not mean the service is ready.

Full guide
bash Example session
```
$curl -s -o /dev/null -w "HTTP %{http_code}\n" --max-time 3 http://localhost:8080HTTP 000# exit 7 - nothing listening yet$curl -s -o /dev/null -w "HTTP %{http_code}\n" http://localhost:8080HTTP 200
```
docker inspect --format '{{.RestartCount}}' NAME

A climbing restart count is a crash loop. docker ps hides it because the container keeps showing as Up.

Full guide
getent group docker

Check whether your user can reach the daemon socket without sudo.

Full guide
bash Example session
```
$getent group dockerdocker:x:983:sysadmin
```