docker

What it does

How to write it

docker COMMAND [OPTIONS] [ARGS]
docker compose [-f compose.yaml] up|down|ps|logs

Main parts

Main commands

run

Create and start a container from an image.

ps [-a]

List running (all) containers.

build -t NAME:TAG .

Build an image from a Dockerfile.

images / image ls

List local images.

pull / push

Download / upload an image.

exec -it C sh

Run a command inside a running container.

logs [-f] C

Show container output.

stop / start / restart / rm C

Container life cycle.

inspect OBJ

Show low-level JSON details.

volume / network

Manage volumes and networks.

compose

Multi-container apps from compose.yaml.

system df / system prune

Disk use / clean up.

login / logout REGISTRY

Log in to a registry.

buildx

Advanced builds (multi-platform, cache).

scout

Check images for known CVEs (Docker Scout).

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Install Docker CE on RHEL and run a test

   #dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
   #dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
   #systemctl enable --now docker
   $docker run --rm hello-world

2. 2Run a web server in the background

   $docker run -d --name web -p 8080:80 --restart unless-stopped nginx:1.27
   $docker ps
   $curl -I http://localhost:8080

3. 3Look inside and read the logs

   $docker logs -f --tail 50 web
   $docker exec -it web sh
   $docker inspect -f '{{.NetworkSettings.IPAddress}}' web

4. 4Build and tag an image

   $cat Dockerfile
   FROM python:3.12-slim
   WORKDIR /app
   COPY requirements.txt .
   RUN pip install --no-cache-dir -r requirements.txt
   COPY . .
   USER 1001
   CMD ["python", "app.py"]
   $docker build -t ghcr.io/s0sta/shop:1.4.0 .

5. 5Push to a registry

   $echo "$GHCR_TOKEN" | docker login ghcr.io -u s0sta --password-stdin
   $docker push ghcr.io/s0sta/shop:1.4.0

6. 6Run a hardened container

   $docker run -d --name api --read-only --tmpfs /tmp -u 1001:1001 --cap-drop ALL --security-opt no-new-privileges --memory 256m --cpus 0.5 -p 8080:8080 ghcr.io/s0sta/shop:1.4.0

7. 7Keep data in a named volume

   $docker volume create pgdata
   $docker run -d --name db -e POSTGRES_PASSWORD_FILE=/run/secrets/pg -v pgdata:/var/lib/postgresql/data postgres:16

8. 8Run a full stack with Compose

   $cat compose.yaml
   services:
     web:
       image: ghcr.io/s0sta/shop:1.4.0
       ports: ["8080:8080"]
       depends_on: [db]
     db:
       image: postgres:16
       volumes: [pgdata:/var/lib/postgresql/data]
   volumes:
     pgdata: {}
   $docker compose up -d
   $docker compose ps
   $docker compose logs -f web
   $docker compose down

9. 9Build for two CPU types

   $docker buildx build --platform linux/amd64,linux/arm64 -t ghcr.io/s0sta/shop:1.4.0 --push .

10. 10Check an image for CVEs

    $docker scout cves ghcr.io/s0sta/shop:1.4.0
    $trivy image ghcr.io/s0sta/shop:1.4.0

11. 11Free disk space

    $docker system df
    $docker system prune -a --volumes

Nothing matches this filter.

Files

/etc/docker/daemon.json

Daemon settings (log driver, registries, userns-remap).

/var/lib/docker/

Images, containers, volumes.

~/.docker/config.json

Registry logins.

/var/run/docker.sock

The daemon API socket (root access!).

Exit codes