Cheat Sheets

docker run flags

# Typical local dev container
docker run -d --name api \
  -p 8080:8080 \
  -v "$(pwd)":/app:ro \
  -e SPRING_PROFILES_ACTIVE=dev \
  --restart unless-stopped \
  myregistry/api:dev

Docker Compose commands

# compose.yaml essentials
services:
  api:
    build: .
    ports: ["8080:8080"]
    environment:
      DATABASE_URL: postgres://db:5432/app
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 10s
      retries: 3
  db:
    image: postgres:16-alpine
    volumes: [pgdata:/var/lib/postgresql/data]

volumes:
  pgdata:

Dockerfile instructions (quick ref)

Debugging commands

# Why did it exit?
docker inspect --format '{{.State.Status}} exit={{.State.ExitCode}} oom={{.State.OOMKilled}}' myapp

# Which IP on the bridge network?
docker inspect --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' myapp

# Follow logs with timestamps
docker logs -f --timestamps myapp 2>&1 | grep -i error

Volume & port syntax

# --mount examples (preferred in prod docs)
docker run --mount type=bind,source=/opt/data,target=/data,readonly nginx
docker run --mount type=volume,source=logs,target=/var/log/myapp nginx
docker run --mount type=tmpfs,target=/run,tmpfs-size=64m nginx

# Compose volume shorthand
volumes:
  - ./src:/app/src:cached    # macOS bind performance hint
  - config:/etc/myapp:ro

Multi-stage patterns

# syntax=docker/dockerfile:1
FROM golang:1.22 AS builder
WORKDIR /src
COPY go.* ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o /out/app .

FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=builder /out/app /app
USER nonroot:nonroot
ENTRYPOINT ["/app"]

BuildKit mount types

# Enable BuildKit
export DOCKER_BUILDKIT=1

# buildx with registry cache (CI)
docker buildx build \
  --cache-from type=registry,ref=myregistry/myapp:buildcache \
  --cache-to type=registry,ref=myregistry/myapp:buildcache,mode=max \
  --platform linux/amd64,linux/arm64 \
  --push -t myregistry/myapp:$(git rev-parse --short HEAD) .

Registry commands

Tagging strategy

# Promotion flow (dev → staging → prod)
# CI pushes:  myapp:sha-a1b2c3d  +  myapp:main
# Staging deploys digest of sha-a1b2c3d
# Prod promotion retags or updates manifest to same digest — never rebuild

CI/CD pipeline steps

# GitHub Actions sketch
- run: hadolint Dockerfile
- uses: docker/build-push-action@v6
  with:
    push: true
    tags: ${{ env.REGISTRY }}/app:${{ github.sha }}
    cache-from: type=gha
    cache-to: type=gha,mode=max
- run: trivy image --exit-code 1 --severity CRITICAL ${{ env.REGISTRY }}/app:${{ github.sha }}

hadolint rules (common)

Scanning — Trivy & Docker Scout

# CI policy example
trivy image --exit-code 1 --severity CRITICAL --ignore-unfixed "$IMAGE"
docker scout cves "$IMAGE" --only-severities critical,high

Linux namespaces reference

# Inspect namespace inodes for container PID
PID=$(docker inspect --format '{{.State.Pid}}' myapp)
ls -la /proc/$PID/ns/    # different inode = isolated from host

cgroup v2 flags & limits

# cgroup v2 path (host)
cat /sys/fs/cgroup/system.slice/docker-$(docker inspect -f '{{.Id}}' myapp).scope/memory.max

# Production defaults
--memory 1g --cpus 2 --pids-limit 500 --restart unless-stopped

Security options

Image hardening checklist

Logging driver comparison

# daemon.json — rotate json-file logs
{
  "log-driver": "json-file",
  "log-opts": { "max-size": "10m", "max-file": "5" }
}

# Per-container override
docker run --log-driver=fluentd --log-opt fluentd-address=localhost:24224 myapp

Docker vs Podman vs containerd