Docker Commands Cheat Sheet

docker ps -a                               # all containers, running or not
docker run -d --name web -p 8080:80 nginx  # run in the background, publish a port
docker logs -f web                         # follow a container's output
docker exec -it web sh                     # shell inside a running container
docker compose up -d                       # start the stack in compose.yaml
docker system df                           # what is using disk space

These commands are for Docker Engine on Linux with the Compose v2 plugin (docker compose, with a space). To install it on Ubuntu, Debian, Fedora or Arch, see Docker on Linux. If every command fails with a socket error, read permission denied on docker.sock. Most commands accept a container name or the first few characters of its ID.

Running containers

Managing containers

Logs, exec and inspection

Images and builds

Volumes and networks

Docker Compose (v2)

Run these in the directory with compose.yaml (or docker-compose.yml), or point to it with -f.

Cleanup and disk space

Common recipes

A minimal compose.yaml for a web app with a database:

services:
  app:
    image: ghcr.io/example/app:latest
    ports:
      - "127.0.0.1:8080:8080"
    environment:
      DATABASE_URL: postgres://app:secret@db:5432/app
    depends_on:
      - db
    restart: unless-stopped
  db:
    image: postgres:17
    environment:
      POSTGRES_USER: app
      POSTGRES_PASSWORD: secret
    volumes:
      - dbdata:/var/lib/postgresql/data
    restart: unless-stopped
volumes:
  dbdata:

Back up and restore a named volume:

docker run --rm -v dbdata:/data -v "$PWD":/backup alpine tar -czf /backup/dbdata.tar.gz -C /data .
docker run --rm -v dbdata:/data -v "$PWD":/backup alpine tar -xzf /backup/dbdata.tar.gz -C /data

Port already taken when starting a container (address already in use)? Find the owner:

sudo ss -tlnp | grep ':8080 '
docker ps --filter publish=8080

Debug a container that exits immediately by overriding its command:

docker logs myapp
docker run --rm -it --entrypoint sh myimage

Run Docker without sudo (security note: the docker group is root-equivalent):

sudo usermod -aG docker "$USER"
newgrp docker      # or log out and back in
docker run --rm hello-world

Disk full because of Docker (see also No space left on device):

docker system df
docker builder prune -f
docker image prune -a -f
sudo du -sh /var/lib/docker/containers/*/*-json.log | sort -h | tail

Cap container log size globally in /etc/docker/daemon.json, then sudo systemctl restart docker (applies to new containers):

{
  "log-driver": "json-file",
  "log-opts": { "max-size": "10m", "max-file": "3" }
}

Gotchas

• docker-compose vs docker compose. The hyphenated v1 tool is end-of-life and missing from current repos. Use the plugin: docker compose. On Debian/Ubuntu from Docker's repo the package is docker-compose-plugin.
• Published ports bypass ufw and firewalld rules. Docker inserts its own iptables/nftables rules, so -p 8080:80 is reachable from the internet even if ufw denies 8080. Bind to 127.0.0.1: for local-only services.
• Option order in docker run. Options go before the image name; anything after it is the command run inside the container. docker run nginx -p 80:80 passes -p to nginx.
• Bind mounts and SELinux. On Fedora and other SELinux systems, a bind mount gives "permission denied" inside the container until you add :Z (private) or :z (shared): -v "$PWD":/app:Z. Don't use it on system directories like /home or /etc.
• restart doesn't reload compose changes. After editing compose.yaml, run docker compose up -d to recreate the changed services.
• :latest is not "newest". It's just a tag, and docker run won't re-pull it. Pin versions and docker compose pull to update.
• Exit code 137 means SIGKILL, usually the OOM killer or a --memory limit; check docker inspect -f '{{.State.OOMKilled}}'. Exit code 143 is a normal SIGTERM stop.

Reference: Docker CLI reference and Docker Compose docs. The daemon itself is a systemd service; manage it with the systemctl cheat sheet.

Frequently asked questions