← All Cheatsheets

Cloud

Docker

CLI · Dockerfile · Networking · Volumes · Compose · Multi-stage · Best Practices

📦

Essential CLI Commands

# Build image

docker build -t myapp:1.0 .

# Run container

docker run -d -p 3000:3000 --name app myapp:1.0

# Shell into running container

docker exec -it app sh

# View logs

docker logs -f app

# Stop & remove

docker stop app && docker rm app

# Remove all stopped containers

docker container prune

🖼️

Image Commands

# List images

docker images

# Pull from registry

docker pull node:20-alpine

# Tag image

docker tag myapp:1.0 registry/myapp:1.0

# Push to registry

docker push registry/myapp:1.0

# Inspect image layers

docker history myapp:1.0

# Remove dangling images

docker image prune

📄

Dockerfile Instructions

FROMBase image. Always first.

WORKDIRSet working directory.

COPYCopy files from host to image.

ADDLike COPY but supports URLs + tar extraction.

RUNExecute command during build.

ENVSet environment variable.

ARGBuild-time variable (not in final image).

EXPOSEDocument port (does not publish).

CMDDefault command. Overridable at runtime.

ENTRYPOINTFixed command. CMD becomes its args.

VOLUMEDeclare mount point.

USERSwitch to non-root user.

HEALTHCHECKDefine container health probe.

🏗️

Multi-Stage Build

Multi-stage builds produce small production images by separating build tools from runtime. Final image only contains what's needed to run.

Build stageFull SDK, dev deps, compilers

Runtime stageMinimal base, compiled output only

Typical savings70–90% smaller image

# Stage 1: build

FROM node:20 AS builder

WORKDIR /app

COPY package*.json ./

RUN npm ci

COPY . .

RUN npm run build

# Stage 2: runtime

FROM node:20-alpine

WORKDIR /app

COPY --from=builder /app/dist ./dist

CMD ["node", "dist/index.js"]

🌐

Networking

bridgeDefault. Containers on same host communicate via IP.

hostShare host network stack. No isolation. Fastest.

noneNo networking. Fully isolated.

overlayMulti-host networking (Swarm / Kubernetes).

# Create custom network

docker network create mynet

# Run on custom network

docker run --network mynet myapp

💾

Volumes & Storage

Named volume

-v mydata:/app/data

Managed by Docker. Persists across containers.

Bind mount

-v /host/path:/app

Maps host directory. Good for dev.

tmpfs

--tmpfs /tmp

In-memory only. Not persisted.

# List / inspect volumes

docker volume ls

docker volume inspect mydata

🐙

Docker Compose

# docker-compose.yml

services:

app:

build: .

ports: ["3000:3000"]

environment:

- DB_URL=postgres://db/mydb

depends_on: [db]

db:

image: postgres:16

volumes:

- pgdata:/var/lib/postgresql/data

volumes:

pgdata:

Key Commands

docker compose up -d

docker compose down

docker compose logs -f app

docker compose exec app sh

docker compose build --no-cache

docker compose ps

docker compose restart app

✅

Best Practices

→

Use .dockerignore: Exclude node_modules, .git, .env from build context.

→

Non-root user: Add USER node or USER 1001 before CMD.

→

Pin base image versions: node:20.11-alpine not node:latest.

→

One process per container: Separation of concerns. Use Compose for multi-service.

→

Layer caching: Copy package.json first, run npm install, then copy source.

→

Scan for vulnerabilities: docker scout cves or trivy image myapp:1.0