Kernel Panic!

Want to work faster with Docker? This cheat sheet orders the most used Docker CLI commands from highest to lowest frequency, with brief explanations, examples, and tips to help you use each command like a Docker expert.

docker ps

Show running containers (alias: docker container ls

Options: -a (all containers), -q (quiet IDs), -s (size), –filter

docker ps
docker ps -aq

Use -a to view all containers (running and stopped containers), or pipe with -q for scripting.

docker run

Create (and start) a new container from an image, pulling it first if needed.

Common flags: -d (detach), -it (interactive+TTY), –name (assign name), -p (publish ports), -v/–mount (file volumes), –env, –restart

docker run --name web -d -p 8080:80 nginx:latest

This downloads nginx:latest (if needed) and starts a background container named web mapped to port 80 → 8080.

docker images

List all local images (alias: docker image ls)

Flags: -a (all images), –digests, –filter, –format

docker images
docker image ls --filter "dangling=true"

Shows repository, tags, size, and IDs.

docker build

Build an image from a Dockerfile, optionally assigning tags.

Flags: -t|–tag, –build-arg, –target, –file, –pull, –no-cache

docker build -t my-app:1.0 .
docker buildx build --pull -t my-app:latest .

Supports multi‑stage builds and tagging.

docker tag

Create a new tag reference to an existing image.

docker tag ubuntu:20.04 myrepo/ubuntu:latest
docker push myrepo/ubuntu:latest

Tags are mutable pointers, common when publishing new versions.

I usually tag images during the build procedure by passing the -t parameter to the build command.

docker push

Upload an image to a registry (alias: docker image push)

docker tag my‑app:1.0 myrepo/my‑app:1.0
docker push myrepo/my‑app:1.0

Requires a prior docker login command

docker rmi

Remove one or more images (alias: docker image rm)

docker rmi nginx:latest
docker rmi $(docker images -q --filter dangling=true)

Removes image ID or name; cleans up unused images.

docker pull

Force‑pulls a given image (or all its tags) from a registry.

Options: -a|–all-tags

docker pull ubuntu
docker pull --all-tags nginx

The default pulls only the latest tag; –all-tags fetches everything.

docker stop

Gracefully stops one or more running containers

Options: -t|–time (seconds before forced kill)

docker stop my_container
docker stop -t 30 web1

Sends SIGTERM; after timeout, it sends SIGKILL

docker start

Restarts one or more previously stopped containers.

Options: -a (attach STDOUT), -i|–interactive (attach STDIN)

docker start web1
docker start -ai web1

Allows re‑attaching if the container was interactive.

docker attach

Attach your terminal to a running container’s STDOUT/STDERR.

docker attach app

You may need CTRL‑C or CTRL‑P CTRL‑Q to detach without killing the container.

docker logs

View logs from a container (changing over time).

Common flags: -f|–follow, –tail , –timestamps, –details, –since, –until

docker logs -f --tail 50 nginx-web

Streams the latest 50 log lines in real time.

docker rm

Delete stopped containers (alias: docker container rm)

Flags: -f (force/kills), -v (remove anonymous volumes attached)

docker rm my_container
docker rm -f -v $(docker ps -a -q)

Keep your container list clean.

docker inspect

Show low‑level JSON metadata for containers, images, volumes, etc.

Options: –type (restrict type), –format (golang template)

docker inspect web
docker inspect --type image my-app:1.0 | jq '.[0].Config'

Great for debugging configuration or runtime values.

docker cp

Copy files/folders between container and host.

docker cp container:/var/log/app.log ./app.log
docker cp ./config.json web:/app/config.json

Behaves like scp for containers.

docker diff

Show filesystem changes inside a container relative to its base image.

docker diff web1

Presence of A, M, and D marks (Added, Modified, Deleted).

docker commit

Create an image snapshot of a container’s current filesystem.

docker commit web myweb:backup

Use sparingly; layer consistency is usually better inside Dockerfiles.

docker exec

Run a command inside a running container.

Flags: -i (interactive), -t (TTY), -d (detach), -u (user), –workdir, –env

docker exec -it mongo bash
docker exec -d app sleep 60

Helpful to launch shells, introspect state, or debug.

docker network

Manage container networks.

Subcommands: ls (list), create, rm, inspect, connect, disconnect, prune

docker network create --driver bridge my-net
docker network connect my-net web
docker network ls
docker network prune

Defaults to bridge unless using Swarm overlay.

docker volume

Manage persistent storage volumes.

Subcommands: ls, create [name], inspect, rm, prune

docker volume create app_data
docker run -v app_data:/data busybox
docker volume ls
docker volume rm app_data

Docker also auto‑creates a volume if -v name: is used.

docker search

Search Docker Hub for images.

docker search nginx
docker search --filter stars=50 redis

Show other users’ community-rated images quickly.

docker login/logout

Authenticate (or sign out) to private registries.

docker login registry.example.com
docker logout registry.example.com

Credentials saved, so docker push/pull work later.

docker stats

Live stream container resource usage (CPU, memory, I/O, network).

docker stats
docker stats web1 web2

Helps spot anomalies during load testing, for example

docker restart

Stop and then start one or more containers.

docker restart my_container
docker restart -t 30 web1

Useful after config changes, avoids two commands.

docker system prune

Clean up unused objects (containers, networks, images, caches).

Flags: -a (remove all unused images), –volumes, -f (no prompt), –filter

docker system prune
docker system prune -a --volumes

Always be careful: you could delete untagged or unreferenced volumes permanently.

docker kill

Force‑kill a running container by sending SIGKILL

docker kill web1
docker kill --signal=SIGQUIT my_container

Use only if stop fails.

docker history

Show layer history of an image, including build steps.

docker history nginx:latest
docker image history my‑app:1.0

Good for visualizing build size contributions.

docker info

Print runtime system details — server, plugins, number of containers/images, storage driver, etc.

docker info

Quick health check for the environment.

docker top

Show processes running inside a container.

docker top web1

Useful to confirm that expected processes are running.

docker events

Stream real‑time Docker event activity (container, network, image changes).

docker events --filter container=web1

Ideal for scripting or debugging daemon-side issues.

docker system df

Display disk usage (images, containers, local volumes, build cache).

docker system df

Use before docker system prune to estimate reclaimable space.

docker save / load & import / export

Save and reload images, or export/import container filesystems.

docker save my‑app:1.0 | gzip > image.tar.gz
docker load < image.tar.gz

docker export web1 > rootfs.tar
docker import rootfs.tar mybackup:1.0

Good for offline distribution or migrations.

End of the list?

The above order reflects my typical day-to-day Docker CLI usage, and someday this list could be changed as my work evolves.

Many newer users run docker run, pull, ps, stop, logs dozens of times per day, while building image commands or advanced or cleanup commands like diff, events, or system df are used less often but remain essential.

Is always a good idea to take a look at the official Docker CLI documentation: read it at docs.docker.com

Tips for Command Workflows

When scripting, try to filter output with -q (when possible), and pair with xargs; for example docker ps -aq | grep -i 'Exited' | xargs docker rm

Another good tip is templating via –format with docker inspect or docker ps, for example:

docker ps --filter "status=exited" \
  --format '{{.ID}}\t{{.Image}}\t{{.Status}}'

See ya!