Docker 101 🐳 Cheatsheet

A quick-reference for Docker commands, concepts, and internals. Organized for lookup, not for reading.

---

Container Lifecycle

Command	Purpose
docker run <image>	Create + start container
docker run -d <image>	Detached (background)
docker run -it <image> sh	Interactive with TTY
docker run --rm <image>	Auto-remove on exit
docker run --name foo <image>	Named container
docker start <c>	Start stopped container
docker stop <c>	Graceful stop (SIGTERM, then SIGKILL after 10s)
docker kill <c>	Immediate SIGKILL
docker restart <c>	Stop + start
docker pause <c>	Freeze processes (cgroup freezer)
docker unpause <c>	Resume
docker rm <c>	Remove container
docker rm -f <c>	Force remove (running)
docker ps	Running containers
docker ps -a	All containers
docker logs <c>	Container logs
docker logs -f <c>	Follow logs

---

Images

Command	Purpose
docker pull <image>	Pull from registry
docker push <image>	Push to registry
docker images	List local images
docker rmi <image>	Remove image
docker build -t name:tag .	Build from Dockerfile
docker build --no-cache -t name .	Build without cache
docker tag src dst	Tag image
docker save -o img.tar <image>	Export to tar
docker load -i img.tar	Import from tar
docker history <image>	Layer history
docker inspect <image>	Full metadata JSON
docker image prune	Remove dangling images
docker image prune -a	Remove all unused

---

Dockerfile Instructions

Instruction	Purpose
FROM <image>	Base image
WORKDIR /path	Set working directory
COPY src dst	Copy from build context
COPY --from=<stage> src dst	Copy from build stage
ADD src dst	Copy + extract archives + URL
RUN cmd	Execute during build
CMD ["exe","arg"]	Default command (overridable)
ENTRYPOINT ["exe"]	Fixed entrypoint
ENV KEY=val	Environment variable
ARG NAME	Build-time variable
EXPOSE 8080	Document port (no publish)
USER app	Run as user
VOLUME /data	Declare volume
HEALTHCHECK CMD ...	Health check
LABEL k=v	Metadata
SHELL ["/bin/bash","-c"]	Change shell
ONBUILD cmd	Trigger in child images
STOPSIGNAL SIGTERM	Custom stop signal

---

Ports & Networking

Flag	Purpose
-p 8080:80	Host:container port
-p 127.0.0.1:8080:80	Bind to specific host IP
-P	Publish all EXPOSE ports (random host)
--network bridge	Default bridge
--network host	Host network (no isolation)
--network none	No networking
--network mynet	User-defined network
--hostname foo	Container hostname
--dns 8.8.8.8	Custom DNS
--add-host h:ip	/etc/hosts entry

Network command	Purpose
docker network ls	List networks
docker network create mynet	Create bridge network
docker network inspect mynet	Show details
docker network connect mynet <c>	Attach container
docker network disconnect mynet <c>	Detach
docker network rm mynet	Remove

---

Volumes & Storage

Command	Purpose
docker volume create vol	Create volume
docker volume ls	List volumes
docker volume inspect vol	Show details
docker volume rm vol	Remove
docker volume prune	Remove unused

Flag	Purpose
-v vol:/data	Named volume
-v /host:/data	Bind mount
-v /host:/data:ro	Read-only bind
--mount type=bind,src=/h,dst=/d	Explicit mount
--tmpfs /tmp	Temporary filesystem
--read-only	Read-only rootfs

---

Resources & Limits

Flag	Purpose
--memory 512m	Memory limit
--memory-swap 1g	Memory + swap limit
--cpus 1.5	CPU limit (1.5 cores)
--cpuset-cpus 0,1	Pin to specific CPUs
--pids-limit 100	Process limit
--ulimit nofile=1024:1024	FD limit
--blkio-weight 500	Block I/O weight
--device-read-bps /dev/sda:1mb	Read bandwidth limit

---

Security

Flag	Purpose
--user 1000:1000	Run as UID:GID
--read-only	Immutable rootfs
--cap-drop ALL	Drop all capabilities
--cap-add NET_BIND_SERVICE	Add back specific caps
--security-opt no-new-privileges	Prevent escalation
--security-opt seccomp=profile.json	Custom seccomp
--privileged	Full host access — avoid
--userns-remap	User namespace remapping

Common capabilities	Purpose
NET_BIND_SERVICE	Bind ports < 1024
NET_ADMIN	Network configuration
SYS_ADMIN	Mount, namespace ops (dangerous)
SYS_PTRACE	Debug/strace
CHOWN	Change file ownership

---

Compose

Command	Purpose
docker compose up -d	Start stack, detached
docker compose down	Stop + remove containers
docker compose down -v	Also remove volumes
docker compose ps	List services
docker compose logs -f svc	Follow service logs
docker compose exec svc sh	Shell into service
docker compose build	Build images
docker compose restart svc	Restart service
docker compose pull	Pull images

services:
  app:
    image: myapp:1.0
    ports: ["8080:80"]
    environment:
      - KEY=val
    depends_on: [db]
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/health"]
      interval: 10s
      retries: 3
  db:
    image: postgres:16
    volumes: [pgdata:/var/lib/postgresql/data]
    environment:
      POSTGRES_PASSWORD: secret
volumes:
  pgdata:

---

Inspection & Debugging

Command	Purpose
docker inspect <c>	Full JSON metadata
docker inspect -f '{{.State.Pid}}' <c>	Extract a field
docker stats	Live resource usage
docker top <c>	Processes in container
docker diff <c>	Filesystem changes
docker port <c>	Port mappings
docker cp <c>:/path .	Copy from container
docker cp . <c>:/path	Copy to container
docker events	Real-time daemon events
docker system df	Disk usage
docker system prune -a	Remove all unused

---

Networking Internals

Packet path: host → container

Physical NIC → Netfilter PREROUTING (DNAT) → docker0 bridge → veth → container eth0 → app

Key constructs

Construct	Purpose
docker0	Default bridge
br-<id>	User-defined bridge
veth pair	Virtual cable (host ↔ container)
Netfilter DNAT	Rewrites host:port → container:port
conntrack	Reverses NAT on return path
docker-proxy	Userspace fallback for loopback/hairpin

Finding the veth

PID=$(docker inspect -f '{{.State.Pid}}' mycontainer)
IFLINK=$(nsenter -t $PID -n -- cat /sys/class/net/eth0/iflink)
ip -o link | awk -F': ' -v iflink=$IFLINK '$1==iflink{print $2}'

Capture inside container

nsenter -t $PID -n -- tcpdump -nn -i eth0 port 80

---

Storage Driver

Driver	Characteristics
overlay2	Default, good performance
btrfs	Snapshots, needs btrfs
zfs	Snapshots, needs zfs
vfs	Deep copy, slow, testing only

Command	Purpose
docker info | grep "Storage Driver"	Check driver
docker system df -v	Per-image/volume usage

---

Image Build Patterns

Pattern	Dockerfile
Multi-stage	FROM build AS b … FROM scratch
Scratch	FROM scratch + static binary
Distroless	FROM gcr.io/distroless/static
Build cache	COPY pubspec.* . before COPY . .
Non-root	RUN useradd app + USER app

Multi-stage example

FROM golang:1.22 AS build
WORKDIR /app
COPY . .
RUN CGO_ENABLED=0 go build -o /app/server

FROM scratch
COPY --from=build /app/server /server
ENTRYPOINT ["/server"]

---

Health Checks

HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD curl -f http://localhost:8080/health || exit 1

Field	Default
interval	30s
timeout	30s
retries	3
start_period	0s

State	Meaning
starting	Within start_period
healthy	Check passing
unhealthy	Check failing after retries

---

Zero-Downtime Deploy

Swarm rolling

docker service update \
  --image myapp:v2 \
  --update-order start-first \
  --update-failure-action rollback \
  myapp

Blue-green switch

# 1. Deploy new color
docker compose up -d app-green
# 2. Health check directly
curl -sf http://app-green:8080/health
# 3. Swap upstream + reload
echo "upstream app_active { server app-green:8080; }" > nginx/active.conf
docker compose exec nginx nginx -s reload

---

Common Flags Cheatsheet

Flag	Meaning
-d	Detached
-it	Interactive + TTY
--rm	Remove on exit
--name	Container name
-e KEY=val	Environment var
--env-file .env	Env from file
-v src:dst	Volume/bind mount
-p host:cont	Port mapping
-w /path	Working directory
-u user	User
--entrypoint	Override entrypoint
--restart unless-stopped	Restart policy

---

Gotchas

Trap	Reality
EXPOSE publishes port	No; only documents. Use -p
CMD is fixed	Overridable; ENTRYPOINT is not (without --entrypoint)
Container IP is stable	No; changes on restart
docker stop is instant	Sends SIGTERM, waits 10s, then SIGKILL
--privileged = root	Worse; full host capabilities
Container writes persist	Only in writable layer or volumes; lost on rm
COPY . . is cached	Cached until any file changes
latest tag pulls always	Pulled on docker pull, not on docker run
docker ps shows stopped	No; use -a
Bridge DNS	Only user-defined bridges have embedded DNS at 127.0.0.11

---

Quick Decision Tables

Which storage?

Need	Use
Persistent data	Named volume
Host directory access	Bind mount
Temporary scratch	--tmpfs
Read-only config	-v ...:ro

Which network?

Need	Use
Default	bridge
Max performance	host
No network	none
Service discovery by name	User-defined bridge

Which restart policy?

Policy	Behavior
no	Never restart
on-failure	Restart on non-zero exit
always	Always restart
unless-stopped	Restart unless manually stopped

Which build base?

Need	Base
Max compatibility	debian:bookworm-slim
Minimal with shell	alpine
Smallest, no shell	scratch
No shell, some libs	distroless

---

One-Page Flow

IMAGE BUILD
  Dockerfile → docker build → local image → docker push → registry

CONTAINER RUN
  docker run → create namespaces + cgroups → mount rootfs → exec process

NETWORKING
  host:port → Netfilter DNAT → docker0 bridge → veth → container eth0 → app

STORAGE
  writable layer (ephemeral) | volume (persistent) | bind mount (host)

DEBUG
  docker logs | docker exec | docker inspect | nsenter + tcpdump

---

---

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!