← All cheat sheets

DOCKER

Plain-text reference · 7 KB. Read it, search it (Ctrl-F) or print it.

INSTALLATION & SETUP#

# Linux
curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker $USER

# Check installation
docker --version
docker info
docker system info

IMAGES#

docker images                    # List images
docker pull <image>              # Download image
docker pull <image>:<tag>        # Download specific version
docker push <image>              # Push to registry
docker build -t <name> .         # Build from Dockerfile
docker build -t <name>:<tag> .   # Build with tag
docker rmi <image>               # Remove image
docker rmi $(docker images -q)   # Remove all images
docker image prune               # Remove unused images
docker image prune -a            # Remove all unused images
docker history <image>           # Show image history
docker inspect <image>           # Detailed image info
docker save -o file.tar <image>  # Export image
docker load -i file.tar          # Import image
docker tag <image> <new_name>    # Tag an image

CONTAINERS#

# Running
docker run <image>               # Run container
docker run -d <image>            # Run detached
docker run -it <image> /bin/bash # Run interactive
docker run --name <name> <image> # Run with name
docker run -p 8080:80 <image>    # Map port (host:container)
docker run -P <image>            # Map all exposed ports
docker run -v /host:/container <image>  # Mount volume
docker run -e VAR=value <image>  # Set environment variable
docker run --env-file .env <image>      # Env from file
docker run --rm <image>          # Remove after exit
docker run --restart=always <image>     # Auto restart
docker run --network=<network> <image>  # Use network
docker run --memory="512m" <image>      # Limit memory
docker run --cpus="1.5" <image>         # Limit CPU

# Management
docker ps                        # List running containers
docker ps -a                     # List all containers
docker start <container>         # Start container
docker stop <container>          # Stop container
docker restart <container>       # Restart container
docker pause <container>         # Pause container
docker unpause <container>       # Unpause container
docker kill <container>          # Kill container
docker rm <container>            # Remove container
docker rm $(docker ps -aq)       # Remove all containers
docker container prune           # Remove stopped containers

# Interaction
docker exec -it <container> /bin/bash   # Execute command
docker attach <container>        # Attach to container
docker logs <container>          # View logs
docker logs -f <container>       # Follow logs
docker logs --tail 100 <container>      # Last 100 lines
docker top <container>           # Show processes
docker stats                     # Live resource stats
docker inspect <container>       # Detailed info
docker diff <container>          # Show file changes
docker cp <container>:/path /host/path  # Copy from container
docker cp /host/path <container>:/path  # Copy to container
docker export <container> > file.tar    # Export container
docker import file.tar <name>           # Import container

VOLUMES#

docker volume ls                 # List volumes
docker volume create <name>      # Create volume
docker volume rm <name>          # Remove volume
docker volume prune              # Remove unused volumes
docker volume inspect <name>     # Volume details

# Volume mounts
docker run -v <volume>:/path <image>           # Named volume
docker run -v /host/path:/container/path <image>  # Bind mount
docker run -v /container/path <image>          # Anonymous volume
docker run --mount type=bind,src=/host,dst=/container <image>

NETWORKS#

docker network ls                # List networks
docker network create <name>     # Create network
docker network rm <name>         # Remove network
docker network prune             # Remove unused networks
docker network inspect <name>    # Network details
docker network connect <network> <container>    # Connect container
docker network disconnect <network> <container> # Disconnect

# Network types
docker network create --driver bridge <name>    # Bridge (default)
docker network create --driver host <name>      # Host
docker network create --driver overlay <name>   # Swarm overlay

DOCKER COMPOSE#

docker-compose up                # Start services
docker-compose up -d             # Start detached
docker-compose up --build        # Rebuild and start
docker-compose down              # Stop and remove
docker-compose stop              # Stop services
docker-compose start             # Start services
docker-compose restart           # Restart services
docker-compose logs              # View logs
docker-compose logs -f           # Follow logs
docker-compose ps                # List containers
docker-compose exec <service> <cmd>  # Execute command
docker-compose build             # Build services
docker-compose pull              # Pull images
docker-compose config            # Validate config

# docker-compose.yml example
version: '3.8'
services:
  web:
    build: .
    ports:
      - "8080:80"
    volumes:
      - ./app:/app
    environment:
      - DEBUG=true
    depends_on:
      - db
  db:
    image: postgres:13
    volumes:
      - db_data:/var/lib/postgresql/data
    environment:
      - POSTGRES_PASSWORD=secret

volumes:
  db_data:

DOCKERFILE#

FROM ubuntu:20.04                # Base image
LABEL maintainer="name@email"    # Metadata
ENV APP_HOME=/app                # Environment variable
WORKDIR /app                     # Set working directory
COPY . /app                      # Copy files
ADD archive.tar.gz /app          # Add and extract
RUN apt-get update && \          # Run commands
    apt-get install -y nginx
EXPOSE 80                        # Expose port
USER appuser                     # Switch user
VOLUME /data                     # Create volume mount
ENTRYPOINT ["nginx"]             # Main command
CMD ["-g", "daemon off;"]        # Default arguments
HEALTHCHECK CMD curl -f http://localhost/ || exit 1

# Multi-stage build
FROM node:16 AS builder
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
RUN npm run build

FROM nginx:alpine
COPY --from=builder /app/dist /usr/share/nginx/html

CLEANUP#

docker system df                 # Show disk usage
docker system prune              # Remove unused data
docker system prune -a           # Remove all unused data
docker system prune --volumes    # Include volumes

SECURITY#

# Run as non-root
docker run --user 1000:1000 <image>

# Read-only filesystem
docker run --read-only <image>

# Drop capabilities
docker run --cap-drop=ALL <image>

# No new privileges
docker run --security-opt=no-new-privileges <image>

# Scan for vulnerabilities
docker scan <image>

DEBUGGING#

docker events                    # Real-time events
docker system events             # System events
docker logs --timestamps <container>
docker inspect --format='{{.State.Status}}' <container>
docker stats --no-stream         # One-time stats

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.