Docker Wiki

# A tag is a movable pointer
nginx:1.27

# A digest is immutable — always pulls the same bytes
nginx@sha256:42d6f9d6c2a5e8b9b4c0d5d3b5a4b1f9e0c8d7b6a5f4e3d2c1b0a9f8e7d6c5b4

# Add Docker's official GPG key
sudo apt-get update
sudo apt-get install ca-certificates curl gnupg
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

# Add the repository
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update

# Install
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# (Optional) run docker as your user
sudo usermod -aG docker $USER
newgrp docker
docker run hello-world

dnf install -y dnf-plugins-core
dnf config-manager --add-repo https://download.docker.com/linux/fedora/docker-ce.repo
dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
systemctl enable --now docker
docker run hello-world

docker --version
docker compose version
docker info
docker run --rm hello-world

docker run --rm hello-world
# Docker pulls the image, starts a container, prints a greeting, and removes it.
# Behind the scenes: containerd downloads layers, runc creates namespaces,
# the binary inside the image runs, the container exits.

docker run --rm -it ubuntu:24.04 bash
# -i  keep STDIN open
# -t  allocate a pseudo-TTY
# --rm  remove the container when it exits

docker run -d --name web -p 8080:80 nginx:1.27-alpine
# -d        detached (background)
# --name    human-readable name
# -p        publish: host:container port

docker logs -f web
docker ps
curl -sI http://localhost:8080

docker stop web && docker rm web

# Get the IP of the last started container
docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' $(docker ps -q | head -1)

# Run a command in every running container
docker ps -q | xargs -I{} docker exec {} sh -c 'echo running in $(hostname)'

# Tail logs of every container that has a label
docker logs -f $(docker ps -q --filter label=app=web)

# Grep container image for a string (build context only)
grep -rIl "TODO" .

# Pretty-print running processes across all containers
for c in $(docker ps -q); do
  echo "=== $c ==="
  docker top $c
done

# 1) Pull an image
docker pull python:3.12-slim

# 2) Run a quick experiment
docker run --rm python:3.12-slim python -c 'print(2 ** 32)'

# 3) Tag for your registry
docker tag python:3.12-slim ghcr.io/yourorg/myapp:0.1.0

# 4) Push
docker push ghcr.io/yourorg/myapp:0.1.0

docker save -o myapp.tar ghcr.io/yourorg/myapp:0.1.0
# ship the tarball by sneakernet
docker load -i myapp.tar

docker history --no-trunc ghcr.io/yourorg/myapp:0.1.0
docker inspect ghcr.io/yourorg/myapp:0.1.0
dive ghcr.io/yourorg/myapp:0.1.0   # interactive layer explorer

# Remove dangling images
docker image prune

# Remove every image not used by a container
docker image prune -a

# Remove stopped containers, unused networks, dangling images, build cache
docker system prune

# Same plus unused images
docker system prune -a --volumes

docker run -d --name api \
  --cpus="1.5" \
  --memory="512m" \
  --memory-swap="512m" \
  --pids-limit=200 \
  --restart=unless-stopped \
  myapi:1.0

docker top <name>           # processes inside the container
docker port <name>          # port mappings
docker diff <name>          # filesystem changes vs. the image
docker rename <old> <new>   # rename
docker update <name> ...    # change limits/restart policy live
docker wait <name>          # block until exit, print code
docker attach <name>        # attach stdio to PID 1
docker cp <name>:/path ./   # copy files in/out
docker commit <name> img    # snapshot a container's writable layer (avoid in prod)

# Named volume — Docker manages location
docker volume create pgdata
docker run -d --name db -v pgdata:/var/lib/postgresql/data postgres:16

# Bind mount — host path into container
docker run -d --name dev -v $PWD/src:/app/src myapp:dev

# tmpfs
docker run -d --name cache --tmpfs /tmp:rw,size=64m myapi:1.0

# Anonymous volume (auto-created, hard to clean up — usually avoid)
docker run -d --name old -v /data alpine

# Read-only bind mount (config injection)
docker run -d --name web -v $PWD/nginx.conf:/etc/nginx/nginx.conf:ro nginx:1.27

# Inspect
docker volume ls
docker volume inspect pgdata
docker volume rm pgdata

# Backup
docker run --rm \
  -v pgdata:/from:ro \
  -v $PWD:/to \
  alpine tar -czf /to/pgdata.tgz -C /from .

# Restore
docker run --rm \
  -v pgdata:/to \
  -v $PWD:/from \
  alpine tar -xzf /from/pgdata.tgz -C /to

docker network create appnet
docker run -d --name db    --network appnet postgres:16
docker run -d --name api   --network appnet -p 8080:8080 myapi:1.0
docker run -d --name web   --network appnet -p 80:80 nginx:1.27-alpine

# Inside the api container, 'db' resolves via embedded DNS
docker exec api getent hosts db

-p 8080:80          # host:container TCP
-p 8080:80/udp       # UDP
-p 127.0.0.1:8080:80 # bind to a host IP only (safer)
-p 80                # ephemeral host port, container port 80
--expose 8080       # document a port without publishing
-P                   # publish every EXPOSE port on a random host port

docker network ls
docker network inspect appnet
docker exec api cat /etc/resolv.conf
docker exec api ip route
docker exec api ss -tlnp
docker exec api tcpdump -i any -n port 5432   # if tcpdump is installed

# syntax=docker/dockerfile:1.7
FROM node:20-alpine AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev

FROM node:20-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM gcr.io/distroless/nodejs20-debian12 AS runtime
WORKDIR /app
ENV NODE_ENV=production
COPY --from=deps  /app/node_modules ./node_modules
COPY --from=build /app/dist         ./dist
COPY --from=build /app/public       ./public
USER nonroot
EXPOSE 3000
CMD ["dist/server.js"]

# syntax=docker/dockerfile:1.7
# ----- build -----
FROM golang:1.23-alpine AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/app .

# ----- runtime -----
FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /out/app /app
USER nonroot:nonroot
ENTRYPOINT ["/app"]

.git
node_modules
dist
build
*.log
.env
.env.*
!.env.example
.DS_Store
coverage
.vscode
.idea
*.md
!README.md
docker-compose*.yml

name: myapp

services:
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${DB_USER:-app}
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER}"]
      interval: 5s
      timeout: 5s
      retries: 10
    secrets:
      - db_password

  api:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        BUILDKIT_INLINE_CACHE: 1
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      DATABASE_URL: postgres://app:$(cat /run/secrets/db_password)@db:5432/app
    ports:
      - "127.0.0.1:8080:8080"
    secrets:
      - db_password

  web:
    image: nginx:1.27-alpine
    restart: unless-stopped
    depends_on:
      - api
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
    ports:
      - "80:80"

  worker:
    build: .
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    command: ["node", "dist/worker.js"]
    environment:
      DATABASE_URL: postgres://app:$(cat /run/secrets/db_password)@db:5432/app
    secrets:
      - db_password

volumes:
  pgdata:

secrets:
  db_password:
    file: ./secrets/db_password.txt

docker compose up -d            # create + start
docker compose down             # stop + remove containers + network
docker compose down -v          # also remove volumes
docker compose ps               # list service status
docker compose logs -f api      # follow logs
docker compose exec api sh      # shell in service
docker compose run --rm migrate # one-off task
docker compose build --pull     # rebuild, refreshing base images
docker compose pull             # pull all service images
docker compose config           # validate + render the merged config
docker compose profile           # activate a profile (e.g. --profile debug)

services:
  api:
    build: .
    profiles: ["app"]
  debug-tools:
    image: nicolaka/netshoot
    profiles: ["debug"]
    network_mode: service:api
# Run only the debug profile:
#   docker compose --profile debug up -d
# Use multiple compose files:
#   docker compose -f compose.yml -f compose.override.yml -f compose.prod.yml up -d

docker run -d \
  -p 5000:5000 \
  --name registry \
  --restart=always \
  -v registry-data:/var/lib/registry \
  registry:3

docker login                       # Docker Hub
docker login ghcr.io               # GHCR
docker login registry.example.com  # self-hosted
# Reads creds from $HOME/.docker/config.json (or OS keychain)

# After pushing myapp:1.0, ask the registry for the digest
docker buildx imagetools inspect myapp:1.0

# Pull / run by digest
docker pull myapp@sha256:4f3a…c0
docker run myapp@sha256:4f3a…c0

docker run -d --name api \
  --read-only \
  --user 10001:10001 \
  --cap-drop=ALL \
  --security-opt=no-new-privileges:true \
  --security-opt=seccomp=/etc/docker/seccomp/default.json \
  --pids-limit=200 \
  --memory=512m --cpus=1.0 \
  --tmpfs /tmp:size=64m,mode=1777 \
  --network appnet \
  myorg/api@sha256:4f3a…c0

# Built-in
docker scout cves myorg/api:1.0
docker scout recommendations myorg/api:1.0

# Trivy (third-party, very thorough)
trivy image --severity HIGH,CRITICAL myorg/api:1.0
# install: brew install trivy  |  apt install trivy  |  binary from github

# Grype (Anchore)
grype myorg/api:1.0

export DOCKER_CONTENT_TRUST=1
docker push myorg/api:1.0   # prompts for signing key passphrase
# On the consumer side, the same env var refuses any unsigned image

# BAD: code change invalidates npm ci
FROM node:20-alpine
WORKDIR /app
COPY . .
RUN npm ci

# GOOD: dependency layers survive code changes
FROM node:20-alpine
WORKDIR /app
COPY package.json package-lock.json ./
RUN --mount=type=cache,target=/root/.npm npm ci
COPY . .
RUN --mount=type=cache,target=/app/.cache npm run build

docker image inspect myorg/api:1.0 --format '{{.Size}}'
docker history myorg/api:1.0 --no-trunc
dive myorg/api:1.0                     # TUI layer browser
docker save myorg/api:1.0 | tar -tv    # list every file
docker run --rm myorg/api:1.0 ls -la /app

# On the first manager
docker swarm init --advertise-addr <manager-ip>

# On each additional manager / worker
docker swarm join --token <token> <manager-ip>:2377

# Deploy a stack from compose
docker stack deploy -c compose.yml mystack
docker stack services mystack
docker stack ps mystack
docker service scale mystack_api=5
docker service rollback mystack_api

# Inspect / leave
docker node ls
docker service ls
docker swarm leave --force

HEALTHCHECK --interval=10s --timeout=2s --start-period=20s --retries=3 \
  CMD curl -fsS http://localhost:8080/healthz || exit 1

# Use the built-in tini (one flag, no image changes)
docker run --init myorg/api:1.0

# Or build a tiny init image
FROM gcr.io/distroless/nodejs20-debian12
COPY --from=build /out/app /app
# distroless ships no shell, so tini must be PID 1 in another stage

# .github/workflows/build.yml (excerpt)
name: build
on: [push]
jobs:
  image:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: ghcr.io/${{ github.repository }}
          tags: type=sha,format=long
      - uses: docker/build-push-action@v6
        with:
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

# If the container is running
docker exec -it --user root <name> sh

# If it's not running, override the entrypoint
docker run -it --entrypoint sh <image>

# If you only have a stopped container
docker run -it --rm --volumes-from <name> alpine sh

# If the process is wedged and won't take signals
docker kill <name>   # SIGKILL
# or, for a deeper look:
docker run --pid=container:<name> --net=container:<name> --ipc=container:<name> alpine sh -c 'apk add strace && strace -p 1'

# Stop everything & remove all containers, networks, images, volumes, build cache
docker stop $(docker ps -aq) 2>/dev/null
docker system prune -a --volumes

# Nuclear option: remove the data root (Linux)
sudo systemctl stop docker
sudo rm -rf /var/lib/docker
sudo systemctl start docker

docker build -t app:1.0 .                # build from Dockerfile in cwd
docker build -f Dockerfile.prod -t app:1.0 .
docker buildx build --platform=linux/amd64,linux/arm64 -t app:1.0 --push .
docker pull nginx:1.27-alpine
docker images
docker rmi app:1.0
docker image prune -a
docker tag app:1.0 ghcr.io/me/app:1.0
docker push ghcr.io/me/app:1.0
docker save -o app.tar app:1.0
docker load -i app.tar
docker history app:1.0
docker image inspect app:1.0

docker run -d --name api -p 8080:8080 -e NODE_ENV=production app:1.0
docker ps
docker ps -a
docker logs -f api
docker exec -it api sh
docker stop api
docker start api
docker restart api
docker kill api
docker rm api
docker rm -f api            # SIGKILL + remove
docker top api
docker stats
docker inspect api
docker diff api
docker cp api:/etc/config.json .
docker update --memory=1g api
docker rename api api-v1

docker volume create data
docker volume ls
docker volume inspect data
docker volume rm data

docker network create appnet
docker network ls
docker network inspect appnet
docker network connect appnet <container>
docker network disconnect appnet <container>
docker network rm appnet

docker compose up -d
docker compose down -v
docker compose ps
docker compose logs -f
docker compose exec api sh
docker compose build --pull
docker compose pull
docker compose run --rm migrate
docker compose config | yq '.services.api.image'