Essential Docker commands reference — containers, images, volumes, networks, Docker Compose and debugging.
| Command | Description | Example |
|---|---|---|
| docker run | Create and start container | docker run -d -p 8080:80 nginx |
| docker start | Start stopped container | docker start mycontainer |
| docker stop | Stop running container (graceful) | docker stop mycontainer |
| docker kill | Force stop container | docker kill mycontainer |
| docker restart | Stop then start container | docker restart mycontainer |
| docker rm | Remove stopped container | docker rm mycontainer |
| docker rm -f | Force remove running container | docker rm -f mycontainer |
| docker pause / unpause | Freeze / unfreeze container | docker pause mycontainer |
| Command | Description | Example |
|---|---|---|
| docker ps | List running containers | docker ps |
| docker ps -a | List all containers | docker ps -a |
| docker logs | View container logs | docker logs -f mycontainer |
| docker exec | Run command in container | docker exec -it mycontainer bash |
| docker inspect | Detailed container info (JSON) | docker inspect mycontainer |
| docker stats | Live CPU/memory usage | docker stats |
| docker top | Running processes in container | docker top mycontainer |
| docker cp | Copy files to/from container | docker cp file.txt mycontainer:/app/ |
| Command | Description | Example |
|---|---|---|
| docker pull | Download image | docker pull python:3.11 |
| docker push | Upload image to registry | docker push myuser/myimage:tag |
| docker build | Build image from Dockerfile | docker build -t myapp:1.0 . |
| docker images | List local images | docker images |
| docker rmi | Remove image | docker rmi myimage:tag |
| docker tag | Tag an image | docker tag myapp:1.0 myapp:latest |
| docker save | Export image to tar | docker save myapp > myapp.tar |
| docker load | Import image from tar | docker load < myapp.tar |
| Command | Description | Example |
|---|---|---|
| docker volume create | Create named volume | docker volume create mydata |
| docker volume ls | List volumes | docker volume ls |
| docker volume rm | Remove volume | docker volume rm mydata |
| -v host:container | Bind mount | docker run -v /data:/app/data nginx |
| docker network create | Create network | docker network create mynet |
| docker network ls | List networks | docker network ls |
| --network flag | Connect to network | docker run --network mynet nginx |
| Command | Description |
|---|---|
| docker compose up -d | Start all services in background |
| docker compose down | Stop and remove containers |
| docker compose down -v | Stop and remove containers + volumes |
| docker compose logs -f | Follow logs from all services |
| docker compose ps | List compose services |
| docker compose exec app bash | Shell into running service |
| docker compose build | Rebuild images |
| docker compose pull | Pull latest images |
| Practice | Why | Example |
|---|---|---|
| Copy deps manifest before source | Caches dependency layer — only re-runs on manifest change | COPY package.json ./ → RUN npm ci → COPY . . |
| Use multi-stage builds | Strips build tools from final image — 90%+ size reduction | FROM node:20 AS builder ... FROM node:20-alpine AS runtime |
| Use specific base image tags | Prevents silent breakage from upstream changes | FROM python:3.12-slim not FROM python:latest |
| Combine RUN commands with && | Reduces layer count and image size | RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/* |
| Add .dockerignore | Excludes node_modules, .git, build dirs from context | .dockerignore: node_modules, .git, *.log, dist |
| Set WORKDIR explicitly | Avoids accidental writes to / and clarifies context | WORKDIR /app |
| Run as non-root USER | Limits blast radius if container is compromised | RUN adduser -S app && USER app |
| Use COPY not ADD | ADD has hidden behaviour (auto-extracts tar, fetches URLs) | Prefer COPY unless you specifically need ADD features |
| Control | Command / Config | What It Does |
|---|---|---|
| Run as non-root | docker run --user 1000:1000 | Drop root privileges at runtime |
| Read-only filesystem | docker run --read-only | Prevents writes to container FS (use volumes for writable paths) |
| Drop capabilities | docker run --cap-drop ALL --cap-add NET_BIND_SERVICE | Principle of least privilege for Linux capabilities |
| No new privileges | docker run --security-opt no-new-privileges | Prevents setuid/setgid escalation |
| Limit resources | docker run --memory 512m --cpus 1.0 | Prevents noisy-neighbour and DoS from runaway containers |
| Scan image for CVEs | trivy image myapp:latest | Detect known vulnerabilities before pushing |
| Lint Dockerfile | hadolint Dockerfile | Catch security and best-practice violations in CI |
| Use secrets not ENV | docker run --secret id=token,src=./token | Secrets never appear in docker inspect or history |