Overview
The Docker CLI is your primary tool for building, running, and managing containers and images. This cheat sheet covers the commands you reach for every day: building and pulling images, running and inspecting containers, managing volumes and networks, cleaning up resources, and using buildx for multi-platform builds. All commands are current for Docker Engine 27.
Images: build and manage
| Command | What it does | Example |
|---|---|---|
docker build -t <name>:<tag> . |
Build an image from a Dockerfile in current directory | docker build -t myapp:1.0 . |
docker build -f <dockerfile-path> -t <name>:<tag> <context> |
Build using a named Dockerfile | docker build -f Dockerfile.prod -t app:prod . |
docker build --build-arg <key>=<value> -t <name>:<tag> . |
Pass build arguments to the build process | docker build --build-arg NODE_ENV=production -t app:prod . |
docker build -m <memory> -t <name>:<tag> . |
Limit memory during build (e.g., 1g) |
docker build -m 2g -t app:1.0 . |
docker build -t <name>:<tag> --no-cache . |
Disable layer caching (rebuild from scratch) | docker build -t app:1.0 --no-cache . |
docker image ls |
List all images on your system | docker image ls |
docker images |
Shorthand for listing images | docker images |
docker images -a |
List all images including intermediate ones | docker images -a |
docker pull <image>:<tag> |
Download an image from a registry | docker pull nginx:1.27 |
docker pull <registry>/<image>:<tag> |
Pull from a private registry | docker pull registry.example.com/myapp:1.0 |
docker tag <image>:<tag> <new-repo>:<new-tag> |
Create a new tag pointing to an image | docker tag myapp:1.0 registry.example.com/myapp:latest |
docker push <image>:<tag> |
Push an image to a registry (assumes tag includes registry) | docker push registry.example.com/myapp:1.0 |
docker login <registry> |
Authenticate with a Docker registry | docker login docker.io |
docker logout <registry> |
Remove authentication for a registry | docker logout docker.io |
docker rmi <image>:<tag> |
Delete a local image | docker rmi myapp:1.0 |
docker rmi -f <image>:<tag> |
Force-delete an image (even if in use) | docker rmi -f myapp:1.0 |
docker image prune |
Remove dangling images (untagged, unused) | docker image prune |
docker image prune -a |
Remove all unused images | docker image prune -a |
docker inspect <image>:<tag> |
Show detailed information about an image | docker inspect nginx:1.27 |
docker history <image>:<tag> |
Show the history of layers in an image | docker history myapp:1.0 |
Containers: run and interact
| Command | What it does | Example |
|---|---|---|
docker run <image> |
Create and run a container from an image | docker run ubuntu:latest |
docker run -d <image> |
Run a container in detached mode (background) | docker run -d nginx:latest |
docker run -it <image> <command> |
Run interactively with a terminal | docker run -it ubuntu:latest bash |
docker run --name <name> <image> |
Give the container a custom name | docker run --name webserver nginx:latest |
docker run -p <host-port>:<container-port> <image> |
Map a port from host to container | docker run -p 8080:80 nginx:latest |
docker run -p <host-ip>:<host-port>:<container-port> <image> |
Map a port to a specific host IP | docker run -p 127.0.0.1:8080:80 nginx:latest |
docker run -e <VAR>=<value> <image> |
Pass an environment variable | docker run -e DATABASE_URL=postgres://localhost <image> |
docker run --env-file <file> <image> |
Load environment variables from a file | docker run --env-file .env app:latest |
docker run -v <host-path>:<container-path> <image> |
Mount a volume (bind mount) | docker run -v /data:/app/data app:latest |
docker run -v <volume-name>:<container-path> <image> |
Mount a named volume | docker run -v mydata:/app/data app:latest |
docker run -v <container-path> <image> |
Create an anonymous volume | docker run -v /app/data app:latest |
docker run --mount type=bind,source=<host>,target=<container> <image> |
Mount with explicit syntax (more readable) | docker run --mount type=bind,source=/data,target=/app/data app:latest |
docker run --rm <image> |
Automatically delete the container when it exits | docker run --rm ubuntu:latest echo "hello" |
docker run -w <workdir> <image> |
Set working directory inside container | docker run -w /app node:20 npm start |
docker run --user <uid>:<gid> <image> |
Run with a specific user ID | docker run --user 1000:1000 app:latest |
docker run --cpus <count> <image> |
Limit CPU cores (e.g., 0.5 for half a core) |
docker run --cpus 2 app:latest |
docker run -m <memory> <image> |
Limit memory (e.g., 512m, 1g) |
docker run -m 512m app:latest |
docker run --restart=<policy> <image> |
Set restart policy: no, always, on-failure, unless-stopped | docker run --restart=always nginx:latest |
docker run --restart=on-failure:<max-retries> <image> |
Restart only on failure, up to N times | docker run --restart=on-failure:5 app:latest |
docker run --network <network> <image> |
Connect container to a specific network | docker run --network mynet app:latest |
docker run --add-host <host>:<ip> <image> |
Add entries to /etc/hosts inside the container | docker run --add-host example.com:192.168.1.10 app:latest |
docker run --cap-add <capability> <image> |
Add Linux capabilities | docker run --cap-add SYS_ADMIN app:latest |
docker run --cap-drop <capability> <image> |
Drop Linux capabilities | docker run --cap-drop NET_RAW app:latest |
docker run --security-opt=no-new-privileges <image> |
Prevent privilege escalation | docker run --security-opt=no-new-privileges app:latest |
Container inspection and logs
| Command | What it does | Example |
|---|---|---|
docker ps |
List running containers | docker ps |
docker ps -a |
List all containers (running and stopped) | docker ps -a |
docker ps -l |
Show the last container (most recent) | docker ps -l |
docker container ls |
Longhand for listing containers | docker container ls |
docker logs <container> |
Print container logs | docker logs mycontainer |
docker logs -f <container> |
Stream logs continuously (follow) | docker logs -f mycontainer |
docker logs --tail <lines> <container> |
Show only the last N lines | docker logs --tail 50 mycontainer |
docker logs --since <time> <container> |
Show logs since a specific time (e.g., 1h, 10m) |
docker logs --since 1h mycontainer |
docker logs --timestamps <container> |
Include timestamps in output | docker logs --timestamps mycontainer |
docker inspect <container> |
Show detailed JSON configuration of a container | docker inspect mycontainer |
docker stats |
Show live CPU, memory, network, and I/O stats for all containers | docker stats |
docker stats <container> |
Show stats for a specific container | docker stats mycontainer |
docker top <container> |
Show running processes inside a container | docker top mycontainer |
docker diff <container> |
Show changes to the filesystem since container start | docker diff mycontainer |
docker port <container> |
List port mappings for a container | docker port mycontainer |
Container lifecycle
| Command | What it does | Example |
|---|---|---|
docker start <container> |
Start a stopped container | docker start mycontainer |
docker stop <container> |
Gracefully stop a running container | docker stop mycontainer |
docker stop --time <seconds> <container> |
Wait N seconds before killing (default 10) | docker stop --time 30 mycontainer |
docker kill <container> |
Force-stop a container (SIGKILL) | docker kill mycontainer |
docker restart <container> |
Stop and start a container | docker restart mycontainer |
docker pause <container> |
Pause a running container (freeze processes) | docker pause mycontainer |
docker unpause <container> |
Resume a paused container | docker unpause mycontainer |
docker rm <container> |
Delete a stopped container | docker rm mycontainer |
docker rm -f <container> |
Force-delete a running container | docker rm -f mycontainer |
docker container prune |
Remove all stopped containers | docker container prune |
Exec: run commands inside running containers
| Command | What it does | Example |
|---|---|---|
docker exec <container> <command> |
Run a command inside a container (non-interactive) | docker exec mycontainer ps aux |
docker exec -it <container> bash |
Run bash interactively inside a container | docker exec -it mycontainer bash |
docker exec -it <container> sh |
Run sh (works in smaller images with no bash) | docker exec -it mycontainer sh |
docker exec -u <user> <container> <command> |
Run as a specific user | docker exec -u nobody mycontainer whoami |
docker exec -w <workdir> <container> <command> |
Run in a specific working directory | docker exec -w /app mycontainer npm start |
docker exec -e <VAR>=<value> <container> <command> |
Pass an environment variable for this exec | docker exec -e DEBUG=1 mycontainer app |
Volumes and persistent storage
| Command | What it does | Example |
|---|---|---|
docker volume create <name> |
Create a named volume | docker volume create mydata |
docker volume ls |
List all volumes | docker volume ls |
docker volume inspect <name> |
Show detailed information about a volume | docker volume inspect mydata |
docker volume rm <name> |
Delete a volume | docker volume rm mydata |
docker volume prune |
Remove unused volumes | docker volume prune |
docker volume prune -a |
Remove all unused volumes (use with caution) | docker volume prune -a |
Networks
| Command | What it does | Example |
|---|---|---|
docker network create <name> |
Create a custom bridge network | docker network create mynet |
docker network ls |
List all networks | docker network ls |
docker network inspect <name> |
Show detailed information about a network | docker network inspect mynet |
docker network connect <network> <container> |
Attach a running container to a network | docker network connect mynet mycontainer |
docker network disconnect <network> <container> |
Detach a container from a network | docker network disconnect mynet mycontainer |
docker network rm <name> |
Delete a network | docker network rm mynet |
docker network prune |
Remove unused networks | docker network prune |
Context (for multiple Docker hosts)
| Command | What it does | Example |
|---|---|---|
docker context ls |
List available Docker contexts | docker context ls |
docker context create <name> --description "<desc>" --docker "host=<host>" |
Create a new context (e.g., for a remote host) | docker context create prod --docker "host=ssh://user@prod.example.com" |
docker context use <name> |
Switch to a different Docker context | docker context use prod |
docker context inspect <name> |
Show details of a context | docker context inspect prod |
System cleanup and maintenance
| Command | What it does | Example |
|---|---|---|
docker system prune |
Remove stopped containers, dangling images, unused networks | docker system prune |
docker system prune -a |
Also remove all unused images (not just dangling) | docker system prune -a |
docker system prune --volumes |
Also remove unused volumes | docker system prune --volumes |
docker system df |
Show disk usage by images, containers, and volumes | docker system df |
docker system events |
Stream real-time Docker events (pull, push, build, run, etc.) | docker system events |
Buildx: multi-platform builds
| Command | What it does | Example |
|---|---|---|
docker buildx ls |
List available build drivers and platforms | docker buildx ls |
docker buildx create --name <builder> |
Create a new builder instance | docker buildx create --name mybuilder |
docker buildx use <builder> |
Switch to a builder | docker buildx use mybuilder |
docker buildx build --platform <platforms> -t <image>:<tag> . |
Build for multiple platforms (e.g., linux/amd64,linux/arm64) |
docker buildx build --platform linux/amd64,linux/arm64 -t app:1.0 . |
docker buildx build --platform <platforms> --push -t <image>:<tag> . |
Build and push multi-platform image to registry | docker buildx build --platform linux/amd64,linux/arm64 --push -t registry.example.com/app:1.0 . |
docker buildx build --platform <platforms> --output type=docker -t <image>:<tag> . |
Build for multiple platforms and load into local Docker (single-platform only) | docker buildx build --platform linux/amd64 --output type=docker -t app:1.0 . |
Patterns you’ll reuse
# Clean up everything (use cautiously!)
docker system prune -a --volumes
# Build and tag for a registry in one step
docker build -t registry.example.com/myapp:1.0 .
docker push registry.example.com/myapp:1.0
# Run a temporary container, execute a command, and auto-remove
docker run --rm ubuntu:latest dpkg -l | grep nginx
# Copy files to/from a container
docker cp myfile.txt mycontainer:/app/myfile.txt
docker cp mycontainer:/app/output.log ./
# Get the IP address of a running container
docker inspect mycontainer | grep '"IPAddress"'
# Inspect a layer in an image
docker history myapp:1.0
# Check resource usage of all containers
docker stats --all
# Find containers by image
docker ps -a --filter ancestor=nginx:latest
FAQ
What’s the difference between docker run and docker start?
docker run creates a new container from an image and starts it; docker start resumes a stopped container. Use run for new work, and start to reuse a stopped container.
How do I run a container in the background?
Use docker run -d <image> to detach. The container runs in the background and you get the container ID. Use docker logs <id> to view output.
How do I pull a private image from a registry?
First log in with docker login -u <username> <registry>, then docker pull <registry>/<image>:<tag>. Credentials are cached locally in ~/.docker/config.json.
How do I remove unused Docker resources?
Use docker system prune to remove stopped containers, unused images, and dangling volumes. Add -a to remove all unused images (not just dangling), and --volumes to remove unused volumes too.
How do I run a command inside a running container?
Use docker exec -it <container> bash (or sh for minimal images). The -i keeps stdin open, and -t allocates a pseudo-terminal for interactivity.
How this guide was verified
Written by hand from the official documentation, every command re-checked, and reviewed a second time before publishing. Last reviewed on .
Official sources read for this article