Docker Syntax CLI Containers

docker-syntax-cli-containers

Quick Reference

Container Lifecycle Overview

docker run Flag Categories

Critical Warnings

NEVER use --privileged in production -- it grants the container full host access. ALWAYS use specific --cap-add flags for the exact capabilities needed.

NEVER run containers as root unless technically required. ALWAYS use -u 1000:1000 or define USER in the Dockerfile.

NEVER use --link for container communication -- it is legacy. ALWAYS use user-defined bridge networks with --network.

NEVER use docker exec with chained commands directly -- the shell interprets && on the host. ALWAYS wrap in sh -c "cmd1 && cmd2".

NEVER run docker rm -f on production databases without confirming backups. ALWAYS stop gracefully with docker stop first.

ALWAYS use --rm for one-off containers (tests, migrations, debug shells) to prevent stopped container accumulation.

ALWAYS set --init when running applications that do not handle signals or reap zombie processes (e.g., shell scripts, Node.js without signal handlers).

docker ps -- Filter Cheat Sheet

Filter Options

Status Values

created | restarting | running | removing | paused | exited | dead

Format Placeholders

# Useful one-liners
docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
docker ps -a --filter status=exited --format "{{.Names}}: exited {{.Status}}"
docker ps -q --filter status=exited | xargs docker rm
docker ps --format json

docker inspect -- Common Format Strings

Container State

docker inspect --format='{{.State.Status}}' CONTAINER
docker inspect --format='{{.State.Running}}' CONTAINER
docker inspect --format='{{.State.ExitCode}}' CONTAINER
docker inspect --format='{{.State.Pid}}' CONTAINER
docker inspect --format='{{.State.StartedAt}}' CONTAINER

Network Information

# IP address
docker inspect --format='{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' CONTAINER

# Port bindings
docker inspect --format='{{range $p, $conf := .NetworkSettings.Ports}}{{$p}} -> {{(index $conf 0).HostPort}}{{end}}' CONTAINER

# Network name
docker inspect --format='{{range $k, $v := .NetworkSettings.Networks}}{{$k}}{{end}}' CONTAINER

Configuration

docker inspect --format='{{.Config.Image}}' CONTAINER
docker inspect --format='{{json .Config.Cmd}}' CONTAINER
docker inspect --format='{{range .Config.Env}}{{println .}}{{end}}' CONTAINER
docker inspect --format='{{json .Config.Labels}}' CONTAINER
docker inspect --format='{{index .Config.Labels "com.example.version"}}' CONTAINER

Mounts

docker inspect --format='{{range .Mounts}}{{.Source}} -> {{.Destination}}{{println}}{{end}}' CONTAINER
docker inspect --format='{{json .Mounts}}' CONTAINER

Size

docker inspect --size -f '{{.SizeRootFs}}' CONTAINER
docker inspect --size -f '{{.SizeRw}}' CONTAINER

Health Check

docker inspect --format='{{.State.Health.Status}}' CONTAINER
docker inspect --format='{{json .State.Health}}' CONTAINER

Decision Trees

Which Run Mode?

Need interactive shell?
├── YES → docker run -it --rm IMAGE bash
└── NO → Need background daemon?
    ├── YES → docker run -d --name NAME IMAGE
    └── NO → One-off command?
        ├── YES → docker run --rm IMAGE COMMAND
        └── NO → docker create + docker start

Which Stop Method?

Need graceful shutdown?
├── YES → docker stop [-t SECONDS] CONTAINER
│         (sends SIGTERM, waits grace period, then SIGKILL)
└── NO → Need immediate termination?
    ├── YES → docker kill CONTAINER
    └── NO → Need to send specific signal?
        └── YES → docker kill -s SIGNAL CONTAINER

Exec or Attach?

Need to run a NEW command in running container?
├── YES → docker exec -it CONTAINER COMMAND
└── NO → Need to connect to the MAIN process?
    ├── YES → docker attach CONTAINER
    │         (Ctrl+P, Ctrl+Q to detach without stopping)
    └── NO → Just need logs?
        └── YES → docker logs -f CONTAINER

Common Patterns

Production Container Launch

docker run -d \
  --name myapp \
  --restart unless-stopped \
  --init \
  -u 1000:1000 \
  --read-only \
  --tmpfs /tmp \
  --cap-drop ALL \
  --security-opt no-new-privileges=true \
  -m 512m --cpus 1.5 --pids-limit 200 \
  -p 127.0.0.1:8080:8080 \
  --network mynet \
  --mount source=appdata,target=/data \
  -e NODE_ENV=production \
  --log-opt max-size=10m --log-opt max-file=3 \
  --health-cmd='curl -f http://localhost:8080/health || exit 1' \
  --health-interval=30s \
  myapp:v1.2.3

Debug a Running Container

# Shell into container
docker exec -it myapp sh

# Check processes
docker top myapp

# Stream logs
docker logs -f --tail 100 myapp

# Resource usage
docker stats myapp --no-stream

# Filesystem changes
docker diff myapp

# Full metadata
docker inspect myapp | jq '.[0].State'

Container Cleanup

# Remove specific stopped container and its anonymous volumes
docker rm -v myapp

# Remove ALL stopped containers
docker container prune -f

# Remove containers older than 24 hours
docker container prune -f --filter "until=24h"

# Force remove running container (emergency only)
docker rm -f myapp

Copy Files

# Extract logs from container
docker cp myapp:/var/log/app.log ./app.log

# Inject config into running container
docker cp ./config.yml myapp:/app/config.yml

# Archive mode (preserves UID/GID)
docker cp -a myapp:/app/data ./backup/

Update Running Container Resources

docker update --memory 1g --cpus 2 myapp
docker update --restart always myapp
docker update --pids-limit 300 myapp

Reference Links

• references/commands.md -- Complete flag reference for all container commands
• references/examples.md -- Common container management workflows
• references/anti-patterns.md -- CLI misuse patterns and corrections

Official Sources

• https://docs.docker.com/reference/cli/docker/container/
• https://docs.docker.com/reference/cli/docker/container/run/
• https://docs.docker.com/reference/cli/docker/container/exec/
• https://docs.docker.com/reference/cli/docker/container/logs/
• https://docs.docker.com/reference/cli/docker/container/ls/
• https://docs.docker.com/reference/cli/docker/inspect/