Docker commands

Command-first reference for the Docker CLI: the exact command and flags for containers, images, builds, volumes, networks, Compose, registries and cleanup, starting with a lookup table. Same versions as Docker (Docker Engine 29.x, Compose through docker compose), which explains the concepts, Compose files, networking and security in depth; writing images is in Dockerfile.

Quick lookup

Command anatomy

docker [global flags] <object> <command> [flags] [arguments]
docker --context prod container ls -a --filter status=exited

Commands are grouped by object (management commands): container, image, volume, network, builder / buildx, compose, context, system. The common ones also have older top-level shortcuts, and both forms do the same thing.

• Options go before the image name. In docker run --rm alpine ls -l, -l belongs to ls: everything after the image is the container's command.
• Containers and images take a name, a full ID or any unique ID prefix: docker rm 3f9.
• Most commands accept several targets: docker stop web db, docker rm $(docker ps -aq -f status=exited).
• -f means different things: --filter on ps and images, --format on inspect, --force on rm, rmi and the prune commands. Spell it out in scripts.

docker run

docker run [OPTIONS] IMAGE[:TAG|@DIGEST] [COMMAND] [ARG...]

docker run -d --name web --restart unless-stopped \
  -p 127.0.0.1:8080:80 -v ./site:/usr/share/nginx/html:ro \
  nginx

Ports

Mounts

-v with a missing host path silently creates a root-owned directory; --mount fails instead. Mount kinds and gotchas are in Docker.

Container lifecycle

docker ps --format \
  'table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}'
docker ps -a --filter status=exited --filter name=api
docker ps -q --filter ancestor=postgres:18
docker ps --filter publish=5432
docker ps --filter health=unhealthy
docker ps --filter label=com.docker.compose.project=shop
docker ps --format json | jq -r '.Names'

The state diagram and exit codes (137 OOM or kill, 143 SIGTERM) are in Docker.

Inspect and debug

attach vs exec

Images

docker import --change 'CMD ["/app"]' fs.tar app:flat restores a command after a flatten.

Build and buildx

docker build is an alias of docker buildx build, which uses BuildKit. The context is the directory (or URL) whose files the Dockerfile can COPY; .dockerignore trims it.

docker buildx build --platform linux/amd64,linux/arm64 \
  -t ghcr.io/acme/app:1.4.2 --push .

Emulation versus cross-compilation and the image store are in Docker.

Bake

Bake builds named targets from docker-bake.hcl (or the build: sections of compose.yaml), in parallel.

group "default" {
  targets = ["api", "worker"]
}
 
target "api" {
  context = "./api"
  tags    = ["ghcr.io/acme/api:dev"]
}
 
target "worker" {
  context = "./worker"
  tags    = ["ghcr.io/acme/worker:dev"]
}

docker buildx bake                 # the "default" group
docker buildx bake api --print     # resolved config as JSON
docker buildx bake --set '*.platform=linux/arm64'
docker buildx bake --push

Volumes and networks

# back up a volume to ./pgdata.tgz (stop writers first)
docker run --rm -v pgdata:/v:ro -v "$PWD":/b alpine \
  tar czf /b/pgdata.tgz -C /v .
# restore into a volume
docker run --rm -v pgdata:/v -v "$PWD":/b alpine \
  tar xzf /b/pgdata.tgz -C /v

Compose CLI

docker compose reads compose.yaml (plus compose.override.yaml) in the current directory and acts on the whole project, or on the services you name. File syntax is in Docker.

Start and stop

Inspect

exec vs run

Files, projects and profiles

Build and pull

Registries and login

# GitHub Container Registry with a token
echo "$GITHUB_TOKEN" \
  | docker login ghcr.io -u USERNAME --password-stdin
# AWS ECR (the token lasts 12 hours)
aws ecr get-login-password --region eu-west-1 \
  | docker login --username AWS --password-stdin \
    123456789012.dkr.ecr.eu-west-1.amazonaws.com
# Google Artifact Registry: registers the gcloud helper
gcloud auth configure-docker europe-docker.pkg.dev
# Azure Container Registry
az acr login --name myregistry

Credentials live in ~/.docker/config.json. Without a credential helper they are stored there base64-encoded, readable by anyone who can read the file; a helper keeps them in a keychain instead. Each value below names a program called docker-credential-NAME on your PATH.

{
  "credsStore": "osxkeychain",
  "credHelpers": {
    "<account>.dkr.ecr.<region>.amazonaws.com": "ecr-login",
    "europe-docker.pkg.dev": "gcloud"
  }
}

credsStore applies to every registry; credHelpers overrides it per registry. Docker Hub rate-limits anonymous and free-plan pulls, so log in on build machines and CI runners.

Contexts and remote daemons

A context is a saved daemon endpoint plus settings. Docker Desktop, OrbStack and Colima each register one (for example desktop-linux, orbstack, colima).

The SSH user must be allowed to use the Docker socket on the remote host (member of the docker group, or a rootless daemon). Add ControlMaster auto, ControlPath ~/.ssh/control-%C and ControlPersist yes to that host in ~/.ssh/config so commands reuse one connection; see SSH client config.

System and cleanup

Every prune asks first unless given --force, and takes --filter until=24h or --filter label=… (volume prune: label only). Named volumes go only with docker volume prune -a, docker volume rm or docker compose down -v.

Format and filter

Go templates

--format takes a Go template: fields are written {{.Field}}, table adds column headers and \t separates columns, and json prints a value as JSON. On list commands, --format json prints one JSON object per line, ready for jq. Template functions include json, join, split, lower, upper, title, pad, truncate and println, plus Go's range, index and if.

Filters

--filter key=value narrows list and prune commands. Repeating the same key means or; different keys mean and. label!=key negates.

docker ps -a --filter status=exited --filter status=dead
docker ps --filter name=api --filter status=running
docker images --filter reference='ghcr.io/acme/*'
docker events --filter type=container --filter event=die
docker image prune -a --force --filter until=72h
docker rm $(docker ps -aq --filter status=exited)

References

• Docker CLI reference (opens in a new tab): every command and flag
• docker container run (opens in a new tab), docker container ls (opens in a new tab), docker container exec (opens in a new tab), docker container logs (opens in a new tab), docker container attach (opens in a new tab), docker container cp (opens in a new tab), docker container update (opens in a new tab)
• docker inspect (opens in a new tab), docker image (opens in a new tab), docker image save (opens in a new tab), docker container export (opens in a new tab)
• docker buildx build (opens in a new tab), docker buildx create (opens in a new tab), docker buildx bake (opens in a new tab), Bake guide (opens in a new tab)
• docker volume (opens in a new tab), docker network (opens in a new tab)
• docker compose (opens in a new tab), docker compose up (opens in a new tab), docker compose run (opens in a new tab)
• docker login (opens in a new tab): device-code login, credential stores and helpers
• docker context (opens in a new tab), Docker contexts (opens in a new tab), Protect the Docker daemon socket (opens in a new tab) (SSH access)
• docker system prune (opens in a new tab), docker image prune (opens in a new tab), docker system df (opens in a new tab), Prune unused Docker objects (opens in a new tab)
• Format command and log output (opens in a new tab), Filter commands (opens in a new tab), docker system events (opens in a new tab)
• docker debug (opens in a new tab), JSON File logging driver (opens in a new tab), Configure logging drivers (opens in a new tab)