Docker Commands

Run a Container

docker run creates a container from an image and starts it. Flags go before the image name; anything after the image name replaces the image's default command.

A typical long-running service:

docker run -d --name web \
  -p 8080:80 \
  -v data:/data \
  --restart unless-stopped \
  nginx

docker run --name web fails with Conflict. The container name "/web" is already in use when an old container with that name exists, stopped or not. Remove it first with docker rm web; see Error response from daemon for the other common variants. For multi-container apps, put all of this in a compose file instead: see the docker compose commands sheet or the Docker Compose generator.

List Containers

docker ps and docker container ls are the same command. Docker added the docker container ..., docker image ..., docker volume ... groupings in 2017 and kept the short forms as aliases, so use whichever you type faster.

Stop, Start and Restart

A container that stops on its own the moment it starts has a main process that exited; run docker logs web to see why. One that goes Restarting (1) over and over is the same problem under a restart policy; see Docker container keeps restarting.

Remove Containers

Removing a container does not remove its image or its named volumes.

Exec Into a Container

exec needs a running container. To poke at a stopped one, copy files out with docker cp or start it with a different command: docker run -it --entrypoint sh image.

Logs

Docker captures whatever the container's main process writes to stdout and stderr. Files the app writes inside the container do not show up here.

Logs grow without limit unless you cap them. In daemon.json set "log-driver": "json-file" with "log-opts": {"max-size": "10m", "max-file": "3"}, or pass --log-opt max-size=10m to docker run.

Copy Files

docker cp works on running and stopped containers. Paths are container:/path on the container side.

Files copied in are owned by root unless you use -a. For anything more than a one-off, use a bind mount or a volume instead.

Build Images

The build context is the . at the end: everything in that directory is sent to the daemon, so add a .dockerignore with node_modules, .git and build output in it. Starting from scratch? The Dockerfile generator writes a sensible multi-stage file for common stacks.

Pull, Push and Login

latest is only a tag, not a promise of the newest version: docker pull fetches whatever the publisher last tagged latest, and a running container does not update itself when you pull. Pull, then recreate the container.

Remove Images

image is being used by running container means exactly that: stop and remove the container, then rmi works. image has dependent child images means another image was built on top of it; remove the child first.

Clean Up

Docker never deletes anything on its own. Stopped containers, old images, build cache and orphaned volumes pile up until the disk is full.

docker system prune -a --volumes removes every volume that no running container is using right now. A database container that happens to be stopped counts as "not using" its volume, and the data is gone with no undo. Stop and think before adding --volumes. If the disk is already full, see Docker no space left on device for the order to do things in.

Volumes

Named volumes are managed by Docker and live under /var/lib/docker/volumes. Bind mounts map a host path you choose.

Bind mount paths must be absolute, which is why $(pwd) shows up so often. Back up a named volume with a throwaway container:

docker run --rm -v data:/data -v $(pwd):/backup alpine \
  tar czf /backup/data.tar.gz -C /data .

Restore it the same way with tar xzf /backup/data.tar.gz -C /data.

Networks

Containers on the same user-defined network reach each other by container name. The default bridge network does not do name resolution, so create one.

From inside a container, host.docker.internal reaches the host machine on Docker Desktop; on Linux add --add-host host.docker.internal:host-gateway.

Inspect and Stats

docker inspect output is Go template territory: -f takes {{.Field.Subfield}} and {{json .Field}}. Pipe the plain output into jq when the template gets hard to read.

Dockerfile Instructions

The essentials, in the order they usually appear. Each instruction that changes the filesystem (RUN, COPY, ADD) creates a layer, and Docker caches layers from the top down, so put the things that change least first.

Use the JSON array form (["node", "server.js"]) for CMD and ENTRYPOINT. The shell form (CMD node server.js) wraps the command in sh -c, so PID 1 is the shell and your process never sees the SIGTERM from docker stop. A multi-stage skeleton:

FROM node:22-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:22-alpine
WORKDIR /app
ENV NODE_ENV=production
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
USER node
EXPOSE 3000
CMD ["node", "dist/server.js"]

The Dockerfile generator produces this shape for Node, Python, Go and others.

Gotchas

• permission denied while trying to connect to the Docker daemon socket means your user is not in the docker group. sudo usermod -aG docker $USER, then log out and in. If the socket is missing altogether, the daemon is not running: see Cannot connect to the Docker daemon.
• A container lives as long as its main process. docker run -d ubuntu exits immediately because bash with no terminal has nothing to do. Give it a real service, or -it for a shell.
• docker stop waits ten seconds and then kills. Apps that ignore SIGTERM (usually because the Dockerfile used the shell form of CMD) always take the full ten seconds and lose in-flight work.
• docker pull does not update running containers. Pull, then docker rm -f and docker run again (or docker compose up -d, which does this for you).
• docker system prune -a --volumes deletes volumes of stopped containers, including databases. Leave --volumes off unless you mean it.
• docker rmi refuses while any container, even a stopped one, references the image. docker ps -a --filter ancestor=image finds them.
• Bind mount paths on docker run -v must be absolute. ./data:/data only works in compose files; on the command line use -v $(pwd)/data:/data.
• Anything beyond one or two containers belongs in a compose.yaml. The docker compose commands sheet covers the CLI and the file format.