Docker

docker context show                 # which daemon the CLI targets
docker ps -a                        # status, exit codes, published ports
docker logs --tail 100 myapp        # stdout/stderr of PID 1 only
docker inspect -f '{{.State.Status}} {{.State.ExitCode}} {{.State.OOMKilled}}' myapp

docker run -d --name myapp \
  -p 127.0.0.1:8080:80 \
  -e DB_HOST=db \
  -v mydata:/app/data \
  --memory 512m --cpus 1.5 \
  --restart unless-stopped \
  nginx:1.27-alpine

docker run --rm -it alpine:3.20 sh          # throwaway shell
docker stop myapp                           # SIGTERM to PID 1, SIGKILL after 10s
docker stop -t 30 myapp                     # give it 30s to drain
docker start myapp                          # same sandbox, same filesystem, new process
docker rm -f myapp                          # kill and remove
docker update --memory 1g myapp             # limits are the exception: changeable in place

docker pull nginx:1.27-alpine
docker images
docker history myapp:1.0                    # per-layer size and instruction
docker image inspect -f '{{.Config.Entrypoint}} {{.Config.Cmd}}' myapp:1.0
docker tag myapp:1.0 registry.example.com/myapp:1.0
docker push registry.example.com/myapp:1.0
docker image prune -a                       # anything not referenced by a container

FROM golang:1.23-alpine AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download                          # cached until the manifests change
COPY . .
RUN CGO_ENABLED=0 go build -trimpath -o /out/server .

FROM alpine:3.20
RUN apk add --no-cache ca-certificates && adduser -S -u 10001 app
COPY --from=build /out/server /usr/local/bin/server
USER app
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=3s --retries=3 CMD wget -qO- http://127.0.0.1:8080/health || exit 1
ENTRYPOINT ["server"]
CMD ["--port", "8080"]

docker volume create mydata
docker run -v mydata:/var/lib/postgresql/data postgres:17   # named volume
docker run -v "$PWD/src:/app/src:ro" myapp                  # bind mount, read-only
docker run --mount type=tmpfs,destination=/tmp myapp        # memory-backed scratch
docker volume inspect mydata                                # Mountpoint on the host
docker volume ls -f dangling=true                           # not attached to any container

docker run --rm -v mydata:/data -v "$PWD:/backup" alpine tar czf /backup/mydata.tgz -C /data .

docker network create mynet
docker run -d --network mynet --name db postgres:17
docker run --rm --network mynet alpine getent hosts db     # name resolves to the container IP
docker network connect mynet myapp                          # attach a running container
docker network inspect mynet -f '{{json .Containers}}'

docker logs -f --since 15m --timestamps myapp
docker exec -it myapp sh                                    # or bash on Debian-based images
docker exec myapp ps -eo pid,comm,rss                       # what is actually running
docker stats --no-stream                                    # live CPU, memory, I/O
docker top myapp                                            # host-side view of the processes
docker diff myapp                                           # files changed since the image
docker cp myapp:/etc/nginx/nginx.conf .                     # pull a file out

docker run --rm -it --pid container:myapp --net container:myapp --cap-add SYS_PTRACE nicolaka/netshoot

docker login registry.example.com -u username --password-stdin < token.txt
docker manifest inspect nginx:1.27-alpine                   # digests and platforms, no pull
docker buildx build --platform linux/amd64,linux/arm64 -t registry.example.com/myapp:1.0 --push .

docker system df -v                                         # what is using the space
docker container prune                                      # stopped containers
docker image prune -a --filter "until=168h"                 # images unused for a week
docker builder prune --keep-storage 10GB                    # BuildKit cache is often the bulk
docker system prune                                         # all of the above, no volumes

# Stop everything running
docker stop $(docker ps -q)

# Remove containers that exited non-zero
docker rm $(docker ps -aq -f status=exited)

# Every container's IP on every network
docker inspect -f '{{.Name}} {{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}' $(docker ps -q)

# Images sorted by size
docker images --format '{{.Size}}\t{{.Repository}}:{{.Tag}}' | sort -h -r | head

# Environment of a running container
docker inspect -f '{{range .Config.Env}}{{println .}}{{end}}' myapp

# Follow logs of every container at once
docker ps -q | xargs -P0 -I{} docker logs -f --tail 5 {}

# Which container owns port 8080
docker ps --format '{{.Names}}\t{{.Ports}}' | grep 8080

# Wait until a health check passes
until [ "$(docker inspect -f '{{.State.Health.Status}}' myapp)" = healthy ]; do sleep 1; done