# Docker 29 essentials

Source: https://codewiki.com/cheatsheets/docker/

## Environment and context

- `docker version` — show client and connected engine versions
- `docker compose version` — show the installed Compose plugin version
- `docker info` — inspect engine, storage, network, and runtime configuration
- `docker context show` — print the context used by default
- `docker context ls` — list contexts and their daemon endpoints
- `docker context use production` — make production the default context for later commands

## Dockerfile foundations

- `FROM node:24-bookworm-slim@sha256:ba849c60be29959425b8734d57b8b4b7d56f98edd9504c9af091d5281095a71e` — start from the Node 24 manifest verified on 2026-09-04
- `WORKDIR /app` — create or select the working directory for later instructions
- `COPY --chown=node:node package.json package-lock.json ./` — copy dependency metadata before frequently changed source
- `RUN --mount=type=cache,target=/root/.npm npm ci --omit=dev` — install the lockfile exactly while reusing an npm download cache
- `COPY --chown=node:node app.mjs ./` — copy the runtime source with ownership set in the same layer
- `USER node` — run later instructions and the container as the non-root node user
- `ENTRYPOINT ["node", "app.mjs"]` — make Node the signal-receiving main process without a shell wrapper

## Build images

- `docker build --check .` — evaluate Dockerfile build checks for the current context
- `docker build --pull -t catalog:1.4.0 .` — refresh base references and build a tagged local image
- `docker build --no-cache -t catalog:cold .` — rebuild instructions without cached results
- `docker build --target test -t catalog:test .` — build through the named test stage
- `docker buildx build --platform linux/amd64,linux/arm64 --push -t registry.example.com/catalog:1.4.0 .` — build and push one multi-platform image reference
- `docker buildx imagetools inspect registry.example.com/catalog:1.4.0` — inspect the registry manifest and its platform entries
- `docker image history --no-trunc catalog:1.4.0` — review every image-layer command without truncation

## Images and registries

- `docker pull node:24-bookworm-slim` — download the tag's current manifest and missing layers
- `docker image ls --digests` — list local images with available repository digests
- `docker image inspect catalog:1.4.0` — read the image configuration and content identifiers
- `docker tag catalog:1.4.0 registry.example.com/catalog:1.4.0` — add a registry-qualified tag to the same local image
- `docker login registry.example.com` — authenticate to the registry using the configured credential flow
- `docker push registry.example.com/catalog:1.4.0` — upload the tagged manifest and missing layers
- `docker image rm catalog:1.4.0` — remove this local tag and unreferenced image data

## Container lifecycle

- `docker run --name catalog-api -d -p 127.0.0.1:3000:3000 catalog:1.4.0` — create a detached container with a host-local port
- `docker ps --filter name=catalog-api` — list running containers whose name matches catalog-api
- `docker ps -a --filter status=exited` — list stopped containers with an exited state
- `docker stop --time 30 catalog-api` — send the stop signal and allow thirty seconds before force
- `docker start catalog-api` — restart the existing stopped container without recreating it
- `docker wait catalog-api` — wait for the container to stop and print its exit code
- `docker rm catalog-api` — remove the stopped container and its writable layer

## Inspect and debug

- `docker logs --tail 100 -f catalog-api` — follow logs after printing the latest one hundred lines
- `docker exec -it catalog-api sh` — start an interactive shell in the running container
- `docker inspect --format '{{json .State.Health}}' catalog-api` — print only the container's health state as JSON
- `docker top catalog-api` — show host-visible processes running in the container
- `docker stats --no-stream catalog-api` — take one CPU, memory, network, and I/O usage snapshot
- `docker diff catalog-api` — list filesystem changes from the image baseline
- `docker cp catalog-api:/app/report.json ./report.json` — copy one file from the container to the current directory

## Networks and ports

- `docker network create catalog-net` — create a user-defined bridge network with embedded DNS
- `docker run --name catalog-db -d --network catalog-net postgres:18-alpine@sha256:d3e1620b530c944afa6e887d22eb899824da68e19c52024bf98f5220c88a65b2` — start the pinned database on the application network without publishing it
- `docker run --name catalog-api -d --network catalog-net -p 127.0.0.1:3000:3000 catalog:1.4.0` — join the same network and publish only the application port
- `docker network connect catalog-net metrics-agent` — attach an existing container to the network
- `docker network inspect catalog-net` — inspect connected containers, addresses, and network options
- `docker port catalog-api 3000` — show the host binding for container port 3000

## Volumes and mounts

- `docker volume create catalog-data` — create a Docker-managed named volume
- `docker volume ls` — list named and anonymous local volumes
- `docker run --name catalog-db -d --mount type=volume,src=catalog-data,dst=/var/lib/postgresql/data postgres:18-alpine@sha256:d3e1620b530c944afa6e887d22eb899824da68e19c52024bf98f5220c88a65b2` — persist database files outside the container lifecycle
- `docker run --rm --mount type=bind,src=/srv/catalog/config,dst=/app/config,readonly catalog:1.4.0` — expose one host directory read-only at an explicit path
- `docker volume inspect catalog-data` — inspect the volume driver, mountpoint, labels, and options
- `docker volume rm catalog-data` — delete the unused volume and its data permanently

## Runtime isolation

- `docker run --rm --user 10001:10001 catalog:1.4.0` — override the image user with an explicit non-root UID and GID
- `docker run --rm --read-only --tmpfs /tmp catalog:1.4.0` — make the root filesystem read-only with writable memory-backed temporary space
- `docker run --rm --cap-drop=ALL --cap-add=NET_BIND_SERVICE catalog:1.4.0` — drop Linux capabilities, then restore only low-port binding
- `docker run --rm --security-opt no-new-privileges=true catalog:1.4.0` — prevent the process from gaining privileges through exec
- `docker run --rm --memory 512m --cpus 1.0 catalog:1.4.0` — limit container memory and CPU allocation
- `docker run --rm --pids-limit 200 catalog:1.4.0` — cap the number of processes the container may create
- `docker run --rm --network none catalog:1.4.0` — start the container without external network connectivity

## Compose service model

- `build: { context: . }` — build this service from the current Compose project context
- `ports: ['127.0.0.1:3000:3000']` — publish port 3000 only on the host loopback address
- `depends_on: { db: { condition: service_healthy } }` — wait for the db health check before creating this service
- `volumes: ['catalog-data:/var/lib/postgresql/data']` — mount a named volume at the database data directory
- `read_only: true` — make the service container's root filesystem read-only
- `tmpfs: [/tmp]` — give the service writable temporary memory storage
- `init: true` — run a small init process to forward signals and reap children

## Compose workflow

- `docker compose config --quiet` — parse and validate the resolved Compose model silently
- `docker compose config --services` — print service names after configuration resolution
- `docker compose pull` — pull images required by declared services
- `docker compose up --build --wait` — build, create, and wait for services to run or become healthy
- `docker compose ps` — show containers in the current Compose project
- `docker compose logs --tail 100 -f catalog` — follow the catalog service after its latest one hundred lines
- `docker compose down` — remove project containers and networks but preserve named volumes

## Cleanup checks

- `docker system df -v` — show detailed disk use before deleting Docker objects
- `docker image ls --filter dangling=true` — list untagged images eligible for dangling-image cleanup
- `docker volume ls --filter dangling=true` — list volumes not referenced by any container
- `docker container prune --filter until=24h` — delete stopped containers created more than twenty-four hours ago
- `docker image prune` — delete dangling images after interactive confirmation
- `docker buildx prune --filter until=24h` — delete build cache older than twenty-four hours after confirmation
- `docker volume prune` — delete unused anonymous local volumes and their data after confirmation