# Docker cheat sheet: core commands > Docker cheat sheet of core commands: run, ps, exec, logs, build, images, pull, stop, rm — with the run flags that matter, verified against the official docs. - Page URL: https://itinsighthub.com/docker/basics/ - Markdown variant of this page: append `?format=md` to any URL on this site or send `Accept: text/markdown`. - Full site index for AI assistants: https://itinsighthub.com/llms.txt - Full site export: https://itinsighthub.com/llms-full.txt # Docker cheat sheet: core commands The Docker lifecycle in one line: pull (or build) an **image**, `docker run` it into a **container**, `docker exec` into it, `docker logs` to watch it, and `docker stop`/`docker rm` to retire it. Every other command is a variation on that loop. The commands below behave identically on Docker Desktop (Windows/macOS) and Docker Engine (Linux). Where a container has no shell (e.g. minimal or distroless images), use `docker exec` without `-it` and run a specific binary instead. Published August 22, 2026 ## The run lifecycle A typical session, end to end ``` # Pull an image from Docker Hub docker pull nginx # Run it in the background, mapping host port 8080 to container port 80 docker run -d -p 8080:80 --name web nginx # See what is running (add -a for all containers) docker ps # Watch its logs (add -f to follow, --tail 50 for the last 50 lines) docker logs web # Open a shell inside it docker exec -it web bash # Stop and remove it docker stop web docker rm web ``` *The commands you will type most* | Command | What it does | | --- | --- | | docker run | creates and starts a container from an image (pulling it first if needed) | | docker ps | lists running containers; docker ps -a lists every container, stopped or running | | docker images | lists local images with tag and size | | docker exec -it bash | runs an interactive shell inside a running container | | docker logs | prints a container's stdout/stderr; add -f to follow, --tail 50 to limit | | docker stop | gracefully stops a running container (SIGTERM, then SIGKILL after a timeout) | | docker rm | removes a stopped container; docker rm -f stops and removes in one step | | docker rmi | removes an image | ## The docker run flags that matter Run flags, in order of how often you will type them - **-d, --detach:** run in the background and print the container ID - **-p 8080:80:** publish a port: host 8080 maps to the container's 80 (host:container) - **--name web:** give the container a name instead of a random one - **-v data:/var/lib/db:** mount a named volume (or a host path) so data survives the container - **-e KEY=value:** set an environment variable; repeat for more, or use --env-file - **-it:** interactive + TTY — what you add when you want a shell (-i keeps stdin, -t allocates a terminal) - **--rm:** auto-remove the container when it exits (useful for one-off jobs) - **--restart unless-stopped:** restart policy: unless-stopped, always, on-failure or no (the default) Run flags composed — a real, typical example ``` docker run -d \ --name postgres \ -p 5432:5432 \ -e POSTGRES_PASSWORD=secret \ -v pgdata:/var/lib/postgresql/data \ --restart unless-stopped \ postgres:16 ``` --rm and a named volume (-v name:path) work together — the container deletes itself, the data stays. A bind mount (-v /host/path:/container/path) uses an absolute host path; on Windows/macOS those paths must live under a shared directory (the Docker Desktop file-sharing settings) or the mount silently stays empty. ## Building images A minimal Dockerfile, then building and tagging it ``` # Dockerfile FROM node:20-alpine WORKDIR /app COPY package*.json ./ RUN npm ci --only=production COPY . . EXPOSE 3000 CMD ["node", "server.js"] # Build from the current directory, tag it user/app:1.0 docker build -t user/app:1.0 . # List the image you just built docker images | grep app # Push it to a registry (Docker Hub by default) docker push user/app:1.0 ``` FROM sets the base image, COPY adds files, RUN executes a build-time command, CMD (or ENTRYPOINT) defines the runtime command, and EXPOSE documents a port (it does not publish it — that is still -p at run time). The layer order matters: copy the dependency manifest first so Docker's layer cache can skip reinstalling packages when only your code changes. ## Copying files and inspecting Move files in and out, and see what a container really is - **docker cp :/path/file .:** copy a file out of a container to the host - **docker cp ./file :/path/:** copy a file from the host into a container - **docker inspect :** full JSON metadata: mounts, networks, env, health, IP and more - **docker inspect -f '{{.State.Status}}' :** Go-template extraction of one field (status here) - **docker stats:** live CPU/memory/network per running container - **docker port :** shows the published port mapping for a container ## References - [docker run reference](https://docs.docker.com/reference/cli/docker/container/run/) — the full flag list with examples. - [Dockerfile reference](https://docs.docker.com/reference/dockerfile/) — every instruction, in order of use. ## FAQ **What is the difference between an image and a container?** An image is the immutable template — the filesystem and config that get built or pulled once and shared. A container is a running instance of that image, with its own writable layer, network namespace and process. Many containers can run from one image, and removing a container never deletes the image. **What is the difference between docker run and docker start?** docker run creates a new container from an image and starts it. docker start starts an existing container that was stopped. To re-run an existing container with the same config, use docker start ; to create a fresh instance, use docker run. **How do I get a shell inside a running container?** docker exec -it bash, or sh for images without bash (like Alpine, which ships /bin/sh). The container must have that shell installed — minimal or distroless images do not, in which case run the specific binary instead: docker exec . **Why is my container exiting immediately?** A container runs only as long as its main process (the Dockerfile CMD/ENTRYPOINT) runs. If that command finishes, the container exits. For a long-running service the CMD must block (a server, not a script that returns); for an interactive image use docker run -it and give it a command like bash. Check the exit reason with docker ps -a and docker logs . ## Related tools - [IPv4 subnet calculator](https://itinsighthub.com/subnet-calculator/) — break any CIDR block into network, range, broadcast and usable hosts. - [IP range to CIDR](https://itinsighthub.com/ip-range-to-cidr/) — turn an arbitrary address range into its minimal covering CIDR blocks. - [VLSM calculator](https://itinsighthub.com/vlsm-calculator/) — split a block into right-sized subnets by host requirements. --- © 2026 ITInsightHub · [About](https://itinsighthub.com/about/) · [Contact](https://itinsighthub.com/contact/) · [Privacy](https://itinsighthub.com/privacy/)