DOCKER
INSTALLATION & SETUP#
# Linux curl -fsSL https://get.docker.com | sh sudo usermod -aG docker $USER # Check installation docker --version docker info docker system info
IMAGES#
docker images # List images docker pull <image> # Download image docker pull <image>:<tag> # Download specific version docker push <image> # Push to registry docker build -t <name> . # Build from Dockerfile docker build -t <name>:<tag> . # Build with tag docker rmi <image> # Remove image docker rmi $(docker images -q) # Remove all images docker image prune # Remove unused images docker image prune -a # Remove all unused images docker history <image> # Show image history docker inspect <image> # Detailed image info docker save -o file.tar <image> # Export image docker load -i file.tar # Import image docker tag <image> <new_name> # Tag an image
CONTAINERS#
# Running docker run <image> # Run container docker run -d <image> # Run detached docker run -it <image> /bin/bash # Run interactive docker run --name <name> <image> # Run with name docker run -p 8080:80 <image> # Map port (host:container) docker run -P <image> # Map all exposed ports docker run -v /host:/container <image> # Mount volume docker run -e VAR=value <image> # Set environment variable docker run --env-file .env <image> # Env from file docker run --rm <image> # Remove after exit docker run --restart=always <image> # Auto restart docker run --network=<network> <image> # Use network docker run --memory="512m" <image> # Limit memory docker run --cpus="1.5" <image> # Limit CPU # Management docker ps # List running containers docker ps -a # List all containers docker start <container> # Start container docker stop <container> # Stop container docker restart <container> # Restart container docker pause <container> # Pause container docker unpause <container> # Unpause container docker kill <container> # Kill container docker rm <container> # Remove container docker rm $(docker ps -aq) # Remove all containers docker container prune # Remove stopped containers # Interaction docker exec -it <container> /bin/bash # Execute command docker attach <container> # Attach to container docker logs <container> # View logs docker logs -f <container> # Follow logs docker logs --tail 100 <container> # Last 100 lines docker top <container> # Show processes docker stats # Live resource stats docker inspect <container> # Detailed info docker diff <container> # Show file changes docker cp <container>:/path /host/path # Copy from container docker cp /host/path <container>:/path # Copy to container docker export <container> > file.tar # Export container docker import file.tar <name> # Import container
VOLUMES#
docker volume ls # List volumes docker volume create <name> # Create volume docker volume rm <name> # Remove volume docker volume prune # Remove unused volumes docker volume inspect <name> # Volume details # Volume mounts docker run -v <volume>:/path <image> # Named volume docker run -v /host/path:/container/path <image> # Bind mount docker run -v /container/path <image> # Anonymous volume docker run --mount type=bind,src=/host,dst=/container <image>
NETWORKS#
docker network ls # List networks docker network create <name> # Create network docker network rm <name> # Remove network docker network prune # Remove unused networks docker network inspect <name> # Network details docker network connect <network> <container> # Connect container docker network disconnect <network> <container> # Disconnect # Network types docker network create --driver bridge <name> # Bridge (default) docker network create --driver host <name> # Host docker network create --driver overlay <name> # Swarm overlay
DOCKER COMPOSE#
docker-compose up # Start services
docker-compose up -d # Start detached
docker-compose up --build # Rebuild and start
docker-compose down # Stop and remove
docker-compose stop # Stop services
docker-compose start # Start services
docker-compose restart # Restart services
docker-compose logs # View logs
docker-compose logs -f # Follow logs
docker-compose ps # List containers
docker-compose exec <service> <cmd> # Execute command
docker-compose build # Build services
docker-compose pull # Pull images
docker-compose config # Validate config
# docker-compose.yml example
version: '3.8'
services:
web:
build: .
ports:
- "8080:80"
volumes:
- ./app:/app
environment:
- DEBUG=true
depends_on:
- db
db:
image: postgres:13
volumes:
- db_data:/var/lib/postgresql/data
environment:
- POSTGRES_PASSWORD=secret
volumes:
db_data:
DOCKERFILE#
FROM ubuntu:20.04 # Base image
LABEL maintainer="name@email" # Metadata
ENV APP_HOME=/app # Environment variable
WORKDIR /app # Set working directory
COPY . /app # Copy files
ADD archive.tar.gz /app # Add and extract
RUN apt-get update && \ # Run commands
apt-get install -y nginx
EXPOSE 80 # Expose port
USER appuser # Switch user
VOLUME /data # Create volume mount
ENTRYPOINT ["nginx"] # Main command
CMD ["-g", "daemon off;"] # Default arguments
HEALTHCHECK CMD curl -f http://localhost/ || exit 1
# Multi-stage build
FROM node:16 AS builder
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
RUN npm run build
FROM nginx:alpine
COPY --from=builder /app/dist /usr/share/nginx/html
CLEANUP#
docker system df # Show disk usage docker system prune # Remove unused data docker system prune -a # Remove all unused data docker system prune --volumes # Include volumes
SECURITY#
# Run as non-root docker run --user 1000:1000 <image> # Read-only filesystem docker run --read-only <image> # Drop capabilities docker run --cap-drop=ALL <image> # No new privileges docker run --security-opt=no-new-privileges <image> # Scan for vulnerabilities docker scan <image>
DEBUGGING#
docker events # Real-time events
docker system events # System events
docker logs --timestamps <container>
docker inspect --format='{{.State.Status}}' <container>
docker stats --no-stream # One-time stats
DOCKER CHEATSHEET
=================
Source: https://cheatsheet.johlem.net
INSTALLATION & SETUP
--------------------
# Linux
curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker $USER
# Check installation
docker --version
docker info
docker system info
IMAGES
------
docker images # List images
docker pull <image> # Download image
docker pull <image>:<tag> # Download specific version
docker push <image> # Push to registry
docker build -t <name> . # Build from Dockerfile
docker build -t <name>:<tag> . # Build with tag
docker rmi <image> # Remove image
docker rmi $(docker images -q) # Remove all images
docker image prune # Remove unused images
docker image prune -a # Remove all unused images
docker history <image> # Show image history
docker inspect <image> # Detailed image info
docker save -o file.tar <image> # Export image
docker load -i file.tar # Import image
docker tag <image> <new_name> # Tag an image
CONTAINERS
----------
# Running
docker run <image> # Run container
docker run -d <image> # Run detached
docker run -it <image> /bin/bash # Run interactive
docker run --name <name> <image> # Run with name
docker run -p 8080:80 <image> # Map port (host:container)
docker run -P <image> # Map all exposed ports
docker run -v /host:/container <image> # Mount volume
docker run -e VAR=value <image> # Set environment variable
docker run --env-file .env <image> # Env from file
docker run --rm <image> # Remove after exit
docker run --restart=always <image> # Auto restart
docker run --network=<network> <image> # Use network
docker run --memory="512m" <image> # Limit memory
docker run --cpus="1.5" <image> # Limit CPU
# Management
docker ps # List running containers
docker ps -a # List all containers
docker start <container> # Start container
docker stop <container> # Stop container
docker restart <container> # Restart container
docker pause <container> # Pause container
docker unpause <container> # Unpause container
docker kill <container> # Kill container
docker rm <container> # Remove container
docker rm $(docker ps -aq) # Remove all containers
docker container prune # Remove stopped containers
# Interaction
docker exec -it <container> /bin/bash # Execute command
docker attach <container> # Attach to container
docker logs <container> # View logs
docker logs -f <container> # Follow logs
docker logs --tail 100 <container> # Last 100 lines
docker top <container> # Show processes
docker stats # Live resource stats
docker inspect <container> # Detailed info
docker diff <container> # Show file changes
docker cp <container>:/path /host/path # Copy from container
docker cp /host/path <container>:/path # Copy to container
docker export <container> > file.tar # Export container
docker import file.tar <name> # Import container
VOLUMES
-------
docker volume ls # List volumes
docker volume create <name> # Create volume
docker volume rm <name> # Remove volume
docker volume prune # Remove unused volumes
docker volume inspect <name> # Volume details
# Volume mounts
docker run -v <volume>:/path <image> # Named volume
docker run -v /host/path:/container/path <image> # Bind mount
docker run -v /container/path <image> # Anonymous volume
docker run --mount type=bind,src=/host,dst=/container <image>
NETWORKS
--------
docker network ls # List networks
docker network create <name> # Create network
docker network rm <name> # Remove network
docker network prune # Remove unused networks
docker network inspect <name> # Network details
docker network connect <network> <container> # Connect container
docker network disconnect <network> <container> # Disconnect
# Network types
docker network create --driver bridge <name> # Bridge (default)
docker network create --driver host <name> # Host
docker network create --driver overlay <name> # Swarm overlay
DOCKER COMPOSE
--------------
docker-compose up # Start services
docker-compose up -d # Start detached
docker-compose up --build # Rebuild and start
docker-compose down # Stop and remove
docker-compose stop # Stop services
docker-compose start # Start services
docker-compose restart # Restart services
docker-compose logs # View logs
docker-compose logs -f # Follow logs
docker-compose ps # List containers
docker-compose exec <service> <cmd> # Execute command
docker-compose build # Build services
docker-compose pull # Pull images
docker-compose config # Validate config
# docker-compose.yml example
version: '3.8'
services:
web:
build: .
ports:
- "8080:80"
volumes:
- ./app:/app
environment:
- DEBUG=true
depends_on:
- db
db:
image: postgres:13
volumes:
- db_data:/var/lib/postgresql/data
environment:
- POSTGRES_PASSWORD=secret
volumes:
db_data:
DOCKERFILE
----------
FROM ubuntu:20.04 # Base image
LABEL maintainer="name@email" # Metadata
ENV APP_HOME=/app # Environment variable
WORKDIR /app # Set working directory
COPY . /app # Copy files
ADD archive.tar.gz /app # Add and extract
RUN apt-get update && \ # Run commands
apt-get install -y nginx
EXPOSE 80 # Expose port
USER appuser # Switch user
VOLUME /data # Create volume mount
ENTRYPOINT ["nginx"] # Main command
CMD ["-g", "daemon off;"] # Default arguments
HEALTHCHECK CMD curl -f http://localhost/ || exit 1
# Multi-stage build
FROM node:16 AS builder
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
RUN npm run build
FROM nginx:alpine
COPY --from=builder /app/dist /usr/share/nginx/html
CLEANUP
-------
docker system df # Show disk usage
docker system prune # Remove unused data
docker system prune -a # Remove all unused data
docker system prune --volumes # Include volumes
SECURITY
--------
# Run as non-root
docker run --user 1000:1000 <image>
# Read-only filesystem
docker run --read-only <image>
# Drop capabilities
docker run --cap-drop=ALL <image>
# No new privileges
docker run --security-opt=no-new-privileges <image>
# Scan for vulnerabilities
docker scan <image>
DEBUGGING
---------
docker events # Real-time events
docker system events # System events
docker logs --timestamps <container>
docker inspect --format='{{.State.Status}}' <container>
docker stats --no-stream # One-time stats
Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.