glunty

Docker Cheat Sheet

A searchable reference of Docker CLI commands and Dockerfile instructions and what each one does.

Command What it does
docker build . Build an image from the Dockerfile in the current directory.
docker build -t name:tag . Build an image and give it a name and tag.
docker pull image Download an image from a registry to your local machine.
docker push image Upload a tagged local image to a registry.
docker images List images stored locally with their tags and size.
docker rmi image Remove one or more local images by name or ID.
docker tag src target Create a new tag that points at an existing image.
docker history image Show the layers that make up an image and their sizes.
docker save -o file.tar image Save an image to a tar archive you can move between hosts.
docker load -i file.tar Load an image from a tar archive created by docker save.
docker run image Create and start a new container from an image.
docker run -d image Run a container in the background (detached) and print its ID.
docker run -it image sh Run a container with an interactive terminal, here starting a shell.
docker run -p 8080:80 image Publish a container port to a host port in host:container order.
docker run -e KEY=value image Set an environment variable inside the container.
docker run --rm image Run a container and delete it automatically when it exits.
docker run -v vol:/path image Mount a named volume or host directory into the container.
docker run --name web image Give the container a readable name instead of a random one.
docker ps List running containers with their ports and status.
docker ps -a List all containers, including stopped ones.
docker stop container Stop a running container gracefully, then force it after a timeout.
docker start container Start an existing stopped container again.
docker restart container Stop and start a container in one command.
docker rm container Remove a stopped container.
docker rm -f container Force-remove a container even if it is still running.
docker exec -it container sh Open an interactive shell inside a running container.
docker logs container Print the collected stdout and stderr of a container.
docker logs -f container Stream a container log output live as new lines arrive.
docker inspect container Show low-level details of a container or image as JSON.
docker stats Show a live stream of CPU, memory, and network use per container.
docker cp container:/path ./local Copy files between a container and the host.
docker compose up Build if needed, then create and start every service in the compose file.
docker compose up -d Start all services in the background (detached).
docker compose down Stop and remove the containers and networks that up created.
docker compose build Build or rebuild the images for the services.
docker compose logs Show the combined logs of all services.
docker compose ps List the containers managed by the current compose project.
docker compose exec service sh Run a command in a running service container, such as a shell.
docker compose restart Restart all services without recreating the containers.
docker volume ls List all named volumes on the host.
docker volume create name Create a named volume for persistent data.
docker volume inspect name Show the mount point and settings of a volume.
docker volume rm name Remove a named volume and its stored data.
docker volume prune Delete all volumes not used by any container.
docker network ls List the networks Docker manages.
docker network create name Create a user-defined network so containers can reach each other by name.
docker network inspect name Show the containers and settings attached to a network.
docker network rm name Remove a user-defined network.
FROM image:tag Set the base image the build starts from; usually the first instruction.
WORKDIR /path Set the working directory for later instructions and the running container.
COPY src dest Copy files from the build context into the image.
ADD src dest Copy files, and additionally unpack local tar archives or fetch URLs.
RUN command Execute a command at build time and commit the result as a new layer.
CMD ["executable","arg"] Set the default command run when the container starts; overridable at run time.
ENTRYPOINT ["executable","arg"] Set the executable that always runs; CMD supplies its default arguments.
ENV KEY=value Set an environment variable available during build and at run time.
ARG NAME=default Define a build-time variable passed with --build-arg; not present at run time.
EXPOSE port Document the port the container listens on; does not publish it by itself.
VOLUME /path Declare a mount point whose data is kept outside the image layers.
USER name Set the user that later instructions and the container process run as.
HEALTHCHECK CMD command Define a command Docker runs to test whether the container is healthy.
docker system prune Remove stopped containers, unused networks, dangling images, and build cache.
docker system prune -a Also remove every image not used by a running container (aggressive).
docker image prune Remove dangling images that have no tag and no reference.
docker container prune Remove all stopped containers at once.
docker system df Show how much disk space images, containers, and volumes use.

Runs entirely in your browser. Nothing you type is sent anywhere; open DevTools and watch the Network tab to verify zero requests.

What this tool does

This is a searchable quick reference for the Docker commands you reach for every day, from building and running images to inspecting containers, orchestrating services with Compose, managing volumes and networks, writing a Dockerfile, and reclaiming disk space. Each row pairs the exact command or instruction with a plain-English note on what it does. Type in the filter box to search across both columns, or tap a category button to focus on one area. The whole list is built into the page, so it works offline and sends nothing anywhere.

How to use it

Start typing in the Filter box. Entering run surfaces every way to start a container; entering prune shows the cleanup commands; entering ENTRYPOINT jumps to the Dockerfile instruction. The category buttons (Images, Run, Containers, Compose, Volumes and networks, Dockerfile, Cleanup) narrow the table to one family and combine with the text filter, so you can pick Dockerfile and type COPY to compare it against ADD. Clear the box to see the full sheet again.

Common use cases

  • Recalling the exact flags for a command you use rarely, like docker run -p or docker save.
  • Copying a safe command into your terminal instead of guessing at option order.
  • Deciding between CMD and ENTRYPOINT, or COPY and ADD, while writing a Dockerfile.
  • Finding the right cleanup command to free disk space without wiping images you still need.
  • Reviewing the core Docker workflow before an interview or a new project.

Common pitfalls

  • Confusing CMD and ENTRYPOINT. A value passed on the command line replaces CMD entirely but only supplies arguments to ENTRYPOINT. Pick ENTRYPOINT for the fixed executable and CMD for default arguments, rather than putting the whole command in both.
  • Breaking the layer cache with COPY order. Docker caches each build layer, so copying your whole source before installing dependencies invalidates the cache on every code change. Copy the dependency manifest first, install, then copy the rest of the source.
  • Running prune -a too eagerly. docker system prune -a deletes every image not used by a running container, including base images you will need again and have to re-pull. Read the confirmation prompt, and prefer plain prune when you only want to clear dangling junk.
  • Running as root. Containers default to the root user, so a process that is exploited runs with broad privileges. Add a USER instruction to drop to an unprivileged account once the build steps that need root are done.

Frequently asked questions

What is the difference between CMD and ENTRYPOINT?
CMD sets the default command and arguments for a container, and anything you pass on the docker run command line replaces it entirely. ENTRYPOINT sets the executable that always runs, and CMD then supplies its default arguments, which you can override while the entrypoint stays fixed. A common pattern is an ENTRYPOINT of your program plus a CMD holding default flags, so users override only the flags.
What is the difference between COPY and ADD?
COPY simply copies files and directories from the build context into the image, and that is what you want almost every time. ADD does the same but adds two behaviors: it unpacks a local tar archive into the destination and it can download a remote URL. Because those extras are easy to trigger by accident, the guidance is to use COPY and reach for ADD only when you specifically need to extract a local archive.
What does docker compose up -d do?
docker compose up reads your compose file, builds any images that are missing, then creates and starts every service defined in it. The -d flag runs them in detached mode, so the containers start in the background and your terminal returns to the prompt instead of streaming their logs. You can follow the output afterward with docker compose logs -f.
How do I get a shell in a running container?
Use docker exec -it <container> sh to open an interactive terminal inside a container that is already running, or swap sh for bash if the image includes it. The -i keeps input open and the -t allocates a terminal, which together give you a usable prompt. To instead start a fresh container just for a shell, run docker run -it <image> sh.
What does docker system prune -a remove?
docker system prune removes stopped containers, networks that no container uses, dangling images, and the build cache. Adding -a widens the image cleanup to every image that is not currently used by a running container, not just the untagged dangling ones. That can delete base images you still want, so read the confirmation prompt before you agree.
What is the difference between an image and a container?
An image is a read-only template built from your Dockerfile that packages the filesystem, dependencies, and default command. A container is a running or stopped instance created from an image, with its own writable layer and process. One image can start many containers, in the same way one class can create many objects.
Does this cheat sheet send anything anywhere?
No. The whole command list is baked into the page and every search and filter runs locally in your browser with JavaScript, so nothing you type leaves your machine. Open your browser DevTools and watch the Network tab while you search to confirm there are zero requests.

Embed this tool

Free for any use; attribution appreciated. Paste this on your site:

The embed runs the same tool that lives at this URL. No tracking; no ads inside the embed. Resize height as needed for your layout.

Cite this tool

For academic, journalistic, or technical references. Pick a format:

Citations use 2026 as the publication year. Access date is left as a fillable placeholder where the citation style expects one.

Embedded tool from glunty.com