Back to All Cheatsheet Libraries
cheatsheets
Docker CLI reference, Dockerfile and Compose essentials, and a smaller-faster-image build workflow.
Total Commands: 0
| Category | Command | Description |
|---|---|---|
| Images | docker build -t name:tag . | Builds an image from a Dockerfile in the current directory. |
| Images | docker images | Lists locally stored images with size and creation date. |
| Images | docker pull name:tag | Downloads an image from a registry (Docker Hub by default). |
| Containers | docker run -d -p 8080:80 name | Runs a container detached, mapping host port 8080 to container port 80. |
| Containers | docker ps | Lists running containers. Add -a to include stopped ones. |
| Containers | docker exec -it CONTAINER sh | Opens an interactive shell inside a running container. |
| Containers | docker stop CONTAINER | Gracefully stops a running container (SIGTERM, then SIGKILL after a timeout). |
| Containers | docker rm CONTAINER | Removes a stopped container. |
| Debugging | docker logs -f CONTAINER | Streams a container's stdout/stderr logs in real time. |
| Debugging | docker inspect CONTAINER | Dumps full JSON metadata — network settings, mounts, env vars, and more. |
| Volumes | docker volume ls | Lists named volumes used for persistent container data. |
| Networks | docker network ls | Lists Docker networks — bridge, host, and any custom user-defined ones. |
| Cleanup | docker system prune -a | Removes all unused containers, networks, and images — frees disk space, but is irreversible for anything not currently in use. |
Common Dockerfile Instructions
| Instruction | Purpose |
|---|---|
FROM node:20-alpine | Sets the base image every subsequent instruction builds on. |
WORKDIR /app | Sets the working directory for following instructions and the container's default shell. |
COPY . . | Copies files from the build context into the image. |
RUN npm install | Executes a command at build time — each RUN creates a new cached layer. |
EXPOSE 3000 | Documents the port the container listens on — doesn't actually publish it (that's -p at run time). |
CMD ["node", "server.js"] | The default command run when the container starts, unless overridden. |
docker-compose.yml Essentials
services:
web:
build: .
ports:
- "3000:3000"
depends_on:
- db
db:
image: postgres:16
environment:
POSTGRES_PASSWORD: example
volumes:
- db-data:/var/lib/postgresql/data
volumes:
db-data:
| Command | Purpose |
|---|---|
docker compose up -d | Starts every service defined in the file, detached. |
docker compose down | Stops and removes containers/networks created by up (add -v to also drop volumes). |
docker compose logs -f web | Follows logs for one specific service in the stack. |
1
Order instructions from least to most frequently changed
Copy dependency manifests (package.json) and install before copying the rest of the source — dependency layers stay cached across rebuilds when only app code changes.
2
Use multi-stage builds
A build stage with the full toolchain, then copy only the compiled output into a slim final stage — keeps compilers/dev-dependencies out of the shipped image.
3
Add a .dockerignore
Excludes node_modules, .git, and local env files from the build context — smaller context uploads faster and avoids leaking secrets into an image layer.
4
Don't run as root inside the container
Add a non-root USER instruction before CMD — limits the blast radius if the container is ever compromised.
Quick Tips
Named volumes survive container removal
A container is disposable, but a named volume persists until explicitly removed — always put database data on a volume, never rely on the container's own writable layer.
Compose services resolve each other by name
Inside the stack,
db is a valid hostname for the database service — no hardcoded IPs or manual network config needed. Alpine base images can miss glibc-dependent binaries
musl libc (Alpine's C library) occasionally breaks native Node/Python packages compiled against glibc — if a package misbehaves only in the container, try a slim/bookworm base instead.