Docker cheat sheet

Getting started

Create and run a container in background

$ docker run -d -p 80:80 docker/getting-started

• -d - Run the container in detached mode
• -p 80:80 - Map port 80 to port 80 in the container
• docker/getting-started - The image to use {.marker-none}

Create and run a container in foreground

$ docker run -it -p 8001:8080 --name my-nginx nginx

• -it - Interactive bash mode
• -p 8001:8080 - Map port 8001 to port 8080 in the container
• --name my-nginx - Specify a name
• nginx - The image to use {.marker-none}

General commands

Parameter <container> can be container id or name

Starting & Stopping

Information

Creating

docker create [options] IMAGE
  -a, --attach               # attach stdout/err
  -i, --interactive          # attach stdin (interactive)
  -t, --tty                  # pseudo-tty
      --name NAME            # name your image
  -p, --publish 5000:5000    # port map (host:container)
      --expose 5432          # expose a port to containers
  -P, --publish-all          # publish all ports
      --link container:alias # linking
  -v, --volume `pwd`:/app    # mount (absolute paths needed)
  -e, --env NAME=hello       # env vars

Example

$ docker create --name my_redis --expose 6379 redis:3.0.2

Manipulating

Renaming a Container

docker rename my-nginx my-nginx

Removing a Container

docker rm my-nginx

Updating a Container

docker update --cpu-shares 512 -m 300M my-nginx

Manipulating

Building Images

$ docker build .
$ docker build github.com/creack/docker-firefox
$ docker build - < Dockerfile
$ docker build - < context.tar.gz
$ docker build -t eon/my-nginx .
$ docker build -f myOtherDockerfile .
$ curl example.com/remote/Dockerfile | docker build -f - .

Common Instructions

Best Practices

• Use .dockerignore to exclude files not relevant to the build.
• Minimize the number of layers by combining instructions.
• Use multi-stage builds to reduce size and secure final images.
• Prefer COPY over ADD unless you need to add tar files or from URLs.

Example Dockerfile

# Use an official Python runtime as a parent image
FROM python:3.7-slim

# Set the working directory in the container
WORKDIR /app

# Copy the current directory contents into the container at /app
COPY . /app

# Install any needed packages specified in requirements.txt
RUN pip install --trusted-host pypi.python.org -r requirements.txt

# Make port 80 available to the world outside this container
EXPOSE 80

# Define environment variable
ENV NAME World

# Run app.py when the container launches
CMD ["python", "app.py"]

Basic Volume Commands

Advanced Volume Options

• Create a Volume with Specific Options:

  
  docker volume create --name <volume_name> --driver local \
  --opt type=tmpfs \
  --opt device=tmpfs \
  --opt o=size=100m,uid=1000

Manipulating

Removing a network

docker network rm MyOverlayNetwork

Listing networks

docker network ls

Getting information about a network

docker network inspect MyOverlayNetwork

Connecting a running container to a network

docker network connect MyOverlayNetwork nginx

Connecting a container to a network when it starts

docker run -it -d --network=MyOverlayNetwork nginx

Disconnecting a container from a network

docker network disconnect MyOverlayNetwork nginx

Creating Networks

docker network create -d overlay MyOverlayNetwork

docker network create -d bridge MyBridgeNetwork

docker network create -d overlay \
  --subnet=192.168.0.0/16 \
  --subnet=192.170.0.0/16 \
  --gateway=192.168.0.100 \
  --gateway=192.170.0.100 \
  --ip-range=192.168.1.0/24 \
  --aux-address="my-router=192.168.1.5" \
  --aux-address="my-switch=192.168.1.6" \
  --aux-address="my-printer=192.170.1.5" \
  --aux-address="my-nas=192.170.1.6" \
  MyOverlayNetwork

Clean All

Cleans up dangling images, containers, volumes, and networks (ie, not associated with a container)

docker system prune

Additionally, remove any stopped containers and all unused images (not just dangling images)

docker system prune -a

Containers

Stop all running containers

docker stop $(docker ps -a -q)

Delete stopped containers

docker container prune

Images

Remove all dangling (not tagged and is not associated with a container) images:

docker image prune

Remove all images which are not used by existing containers

docker image prune -a

Volumes

docker volume prune

Remove all volumes not used by at least one container

Basic Commands

Docker Compose simplifies the management of multi-container Docker applications. Here are some essential commands:

Other Useful

Configuration Files

• Primary: docker-compose.yml
• Overrides: docker-compose.override.yml

Versioning

• Specify the Compose file version at the top of the file: version: '3'

Services

Define services that make up your application so they can be run together in an isolated environment.

Volumes

Declare volumes for persistence or as shared directories between services.

Networks

Define networks to enable communication between containers.

Security Scanning

• Scan Images for Vulnerabilities:

  docker scan <image_name>

  Use Docker's built-in scanning capabilities to identify security issues within your images.

Running Containers Securely

• Run as Non-Root User:

  USER nonrootuser

  In your Dockerfile, specify a non-root user for running the container to limit privileges.

• Use Read-Only Filesystems:

  docker run --read-only <image_name>

  Where possible, run containers with a read-only filesystem to prevent modifications.

• Limit Memory and CPU:

  docker run --memory=500m --cpus=2 <image_name>

  Prevent resource abuse by limiting the memory and CPU usage of your containers.

Secure Docker Daemon

• Enable TLS: Secure the Docker daemon by enabling TLS, ensuring that all communications are encrypted and authenticated.

  dockerd --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem -H=0.0.0.0:2376

Networking Security

• Use Custom Bridge Networks: Create custom bridge networks to control which containers can communicate with each other.

Best Practices

• Regularly update Docker and container applications to the latest versions.
• Apply the principle of least privilege in container permissions and capabilities.
• Use Docker Bench for Security to check for common best practices around deploying Docker containers in production.

Docker Hub

Registry commands

Login to a Registry

$ docker login
$ docker login localhost:8080

Logout from a Registry

$ docker logout
$ docker logout localhost:8080

Searching an Image

$ docker search nginx
$ docker search nginx --stars=3 --no-trunc busybox

Pulling an Image

$ docker pull nginx
$ docker pull eon01/nginx localhost:5000/myadmin/nginx

Pushing an Image

$ docker push eon01/nginx
$ docker push eon01/nginx localhost:5000/myadmin/nginx

Batch clean

Volumes

Check volumes

$ docker volume ls

Cleanup unused volumes

$ docker volume prune