Production Reference

Docker Cheat Sheet

Build, run, and manage containers with the Docker commands engineers reach for during local development, CI debugging, and production incident response.

Command-firstProduction notesSecurity warningsHardened patterns

Images

7 commands

docker build -t name:tag .

Build image from Dockerfile

docker images

List local images

docker pull nginx:latest

Pull image from registry

docker push user/img:tag

Push to registry

docker rmi image_id

Remove image

docker image prune

Remove unused images

docker tag img:v1 img:latest

Tag image

Containers

11 commands

docker run -d --name app img

Run detached

docker run -it img bash

Interactive shell

docker run -p 8080:80 img

Map port

docker run -v ./data:/data img

Mount volume

docker run -e KEY=val img

Set env variable

docker run --rm img

Remove after exit

docker ps

Running containers

docker ps -a

All containers

docker stop NAME

Stop container

docker rm NAME

Remove container

docker restart NAME

Restart container

Debugging

7 commands

docker logs NAME

Container logs

docker logs -f NAME

Stream logs

docker exec -it NAME bash

Shell into running

docker inspect NAME

Full container details

docker stats

Live resource usage

docker top NAME

Processes in container

docker diff NAME

Changed files

Docker Compose

8 commands

docker compose up -d

Start all services

docker compose down

Stop and remove

docker compose logs -f

Stream all logs

docker compose ps

Service status

docker compose build

Rebuild services

docker compose exec svc bash

Shell into service

docker compose pull

Pull latest images

docker compose down -v

Remove with volumes

Volumes & Networks

6 commands

docker volume create vol

Create volume

docker volume ls

List volumes

docker volume rm vol

Remove volume

docker network create net

Create network

docker network ls

List networks

docker network inspect net

Network details

Cleanup

5 commands

docker system prune

Remove all unused

docker system prune -a

Remove ALL (incl images)

docker system df

Disk usage

docker container prune

Remove stopped

docker volume prune

Remove unused volumes

Multi-Stage Builds

5 commands

FROM node:22 AS builder

Named build stage

FROM node:22-slim AS runtime

Smaller runtime image

COPY --from=builder /app/dist .

Copy from build stage

COPY --from=0 /app .

Copy from stage index

RUN --mount=type=cache,target=/root/.npm npm ci

BuildKit cache mount

BuildKit & Performance

7 commands

DOCKER_BUILDKIT=1 docker build .

Enable BuildKit

docker buildx build --platform linux/amd64,linux/arm64 .

Multi-arch build

docker buildx create --use

Create buildx builder

--build-arg VAR=val

Pass build argument

.dockerignore

Exclude files from build context

docker build --cache-from img:latest .

Use remote cache

docker build --progress=plain .

Show full build output

Security Best Practices

7 commands

USER nonroot:nonroot

Don't run as root

COPY --chown=nonroot:nonroot . .

Set file ownership

RUN apt-get update && apt-get install -y --no-install-recommends

Minimal packages

docker scan img:tag

Scan for vulnerabilities

docker scout quickview img

Docker Scout analysis

FROM scratch

Empty base image (Go/Rust binaries)

HEALTHCHECK CMD curl -f http://localhost/ || exit 1

Container health check

Docker Compose Advanced

7 commands

depends_on: svc: condition: service_healthy

Wait for health check

deploy: resources: limits: cpus: '0.5'

Resource limits

profiles: [debug]

Optional service profiles

docker compose --profile debug up

Start with profile

docker compose config

Validate compose file

docker compose watch

Auto-rebuild on changes

extends: file: base.yml service: web

Extend base config

Troubleshooting

8 commands

docker logs --tail 100 -f NAME

Last 100 lines + follow

docker inspect --format '{{.State.ExitCode}}' NAME

Exit code

docker events

Real-time Docker events

docker history img:tag

Image layer history

docker export NAME > fs.tar

Export filesystem

docker commit NAME new-img

Create image from container

docker save img > img.tar

Save image to file

docker load < img.tar

Load image from file

All reference sheets