Docker 29 essentials
Printable Docker and Compose commands for builds, containers, networking, storage, security, inspection, and cleanup.
Docker CLI 29.7.2 / Compose 5.5.0 / Node 24 1 page when printed
Environment and context
docker version show client and connected engine versions docker compose version show the installed Compose plugin version docker info inspect engine, storage, network, and runtime configuration docker context show print the context used by default docker context ls list contexts and their daemon endpoints docker context use production make production the default context for later commands Dockerfile foundations
FROM node:24-bookworm-slim@sha256:ba849c60be29959425b8734d57b8b4b7d56f98edd9504c9af091d5281095a71e start from the Node 24 manifest verified on 2026-09-04 WORKDIR /app create or select the working directory for later instructions COPY --chown=node:node package.json package-lock.json ./ copy dependency metadata before frequently changed source RUN --mount=type=cache,target=/root/.npm npm ci --omit=dev install the lockfile exactly while reusing an npm download cache COPY --chown=node:node app.mjs ./ copy the runtime source with ownership set in the same layer USER node run later instructions and the container as the non-root node user ENTRYPOINT ["node", "app.mjs"] make Node the signal-receiving main process without a shell wrapper Build images
docker build --check . evaluate Dockerfile build checks for the current context docker build --pull -t catalog:1.4.0 . refresh base references and build a tagged local image docker build --no-cache -t catalog:cold . rebuild instructions without cached results docker build --target test -t catalog:test . build through the named test stage docker buildx build --platform linux/amd64,linux/arm64 --push -t registry.example.com/catalog:1.4.0 . build and push one multi-platform image reference docker buildx imagetools inspect registry.example.com/catalog:1.4.0 inspect the registry manifest and its platform entries docker image history --no-trunc catalog:1.4.0 review every image-layer command without truncation Images and registries
docker pull node:24-bookworm-slim download the tag’s current manifest and missing layers docker image ls --digests list local images with available repository digests docker image inspect catalog:1.4.0 read the image configuration and content identifiers docker tag catalog:1.4.0 registry.example.com/catalog:1.4.0 add a registry-qualified tag to the same local image docker login registry.example.com authenticate to the registry using the configured credential flow docker push registry.example.com/catalog:1.4.0 upload the tagged manifest and missing layers docker image rm catalog:1.4.0 remove this local tag and unreferenced image data Container lifecycle
docker run --name catalog-api -d -p 127.0.0.1:3000:3000 catalog:1.4.0 create a detached container with a host-local port docker ps --filter name=catalog-api list running containers whose name matches catalog-api docker ps -a --filter status=exited list stopped containers with an exited state docker stop --time 30 catalog-api send the stop signal and allow thirty seconds before force docker start catalog-api restart the existing stopped container without recreating it docker wait catalog-api wait for the container to stop and print its exit code docker rm catalog-api remove the stopped container and its writable layer Inspect and debug
docker logs --tail 100 -f catalog-api follow logs after printing the latest one hundred lines docker exec -it catalog-api sh start an interactive shell in the running container docker inspect --format '{{json .State.Health}}' catalog-api print only the container’s health state as JSON docker top catalog-api show host-visible processes running in the container docker stats --no-stream catalog-api take one CPU, memory, network, and I/O usage snapshot docker diff catalog-api list filesystem changes from the image baseline docker cp catalog-api:/app/report.json ./report.json copy one file from the container to the current directory Networks and ports
docker network create catalog-net create a user-defined bridge network with embedded DNS docker run --name catalog-db -d --network catalog-net postgres:18-alpine@sha256:d3e1620b530c944afa6e887d22eb899824da68e19c52024bf98f5220c88a65b2 start the pinned database on the application network without publishing it docker run --name catalog-api -d --network catalog-net -p 127.0.0.1:3000:3000 catalog:1.4.0 join the same network and publish only the application port docker network connect catalog-net metrics-agent attach an existing container to the network docker network inspect catalog-net inspect connected containers, addresses, and network options docker port catalog-api 3000 show the host binding for container port 3000 Volumes and mounts
docker volume create catalog-data create a Docker-managed named volume docker volume ls list named and anonymous local volumes docker run --name catalog-db -d --mount type=volume,src=catalog-data,dst=/var/lib/postgresql/data postgres:18-alpine@sha256:d3e1620b530c944afa6e887d22eb899824da68e19c52024bf98f5220c88a65b2 persist database files outside the container lifecycle docker run --rm --mount type=bind,src=/srv/catalog/config,dst=/app/config,readonly catalog:1.4.0 expose one host directory read-only at an explicit path docker volume inspect catalog-data inspect the volume driver, mountpoint, labels, and options docker volume rm catalog-data delete the unused volume and its data permanently Runtime isolation
docker run --rm --user 10001:10001 catalog:1.4.0 override the image user with an explicit non-root UID and GID docker run --rm --read-only --tmpfs /tmp catalog:1.4.0 make the root filesystem read-only with writable memory-backed temporary space docker run --rm --cap-drop=ALL --cap-add=NET_BIND_SERVICE catalog:1.4.0 drop Linux capabilities, then restore only low-port binding docker run --rm --security-opt no-new-privileges=true catalog:1.4.0 prevent the process from gaining privileges through exec docker run --rm --memory 512m --cpus 1.0 catalog:1.4.0 limit container memory and CPU allocation docker run --rm --pids-limit 200 catalog:1.4.0 cap the number of processes the container may create docker run --rm --network none catalog:1.4.0 start the container without external network connectivity Compose service model
build: { context: . } build this service from the current Compose project context ports: ['127.0.0.1:3000:3000'] publish port 3000 only on the host loopback address depends_on: { db: { condition: service_healthy } } wait for the db health check before creating this service volumes: ['catalog-data:/var/lib/postgresql/data'] mount a named volume at the database data directory read_only: true make the service container’s root filesystem read-only tmpfs: [/tmp] give the service writable temporary memory storage init: true run a small init process to forward signals and reap children Compose workflow
docker compose config --quiet parse and validate the resolved Compose model silently docker compose config --services print service names after configuration resolution docker compose pull pull images required by declared services docker compose up --build --wait build, create, and wait for services to run or become healthy docker compose ps show containers in the current Compose project docker compose logs --tail 100 -f catalog follow the catalog service after its latest one hundred lines docker compose down remove project containers and networks but preserve named volumes Cleanup checks
docker system df -v show detailed disk use before deleting Docker objects docker image ls --filter dangling=true list untagged images eligible for dangling-image cleanup docker volume ls --filter dangling=true list volumes not referenced by any container docker container prune --filter until=24h delete stopped containers created more than twenty-four hours ago docker image prune delete dangling images after interactive confirmation docker buildx prune --filter until=24h delete build cache older than twenty-four hours after confirmation docker volume prune delete unused anonymous local volumes and their data after confirmation Say it precisely to your AI
rules pack · DevOps and cloud
DevOps and cloud rules for your coding agent
Download the track's pitfalls and review checks in the format your coding agent reads.