Docker CLI

# Arch Linux
pacman -S docker

# Debian / Ubuntu (official repo recommended)
sudo apt update
sudo apt install ca-certificates curl gnupg
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# RHEL / Fedora
sudo dnf config-manager --add-repo https://download.docker.com/linux/fedora/docker-ce.repo
sudo dnf install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh

sudo groupadd docker
sudo usermod -aG docker $USER
newgrp docker

sudo systemctl enable --now docker.service

docker run --rm hello-world

# Enable content trust globally
export DOCKER_CONTENT_TRUST=1

# Pull only signed images (with DCT enabled)
docker pull <repo>:<tag>

# Push and sign an image
docker push <repo>:<tag>

# Inspect signing data
docker trust inspect <repo>:<tag>

# Sign an existing image
docker trust sign <repo>:<tag>

# Revoke trust for a tag
docker trust revoke <repo>:<tag>

# Disable content trust for a single command
DOCKER_CONTENT_TRUST=0 docker pull <repo>:<tag>

# Basic build
docker build -t <repo>:<tag> .

# Build with a specific Dockerfile
docker build -f Dockerfile.prod -t <repo>:<tag> .

# Build with build arguments
docker build --build-arg VERSION=1.0 -t <repo>:<tag> .

# Build without cache
docker build --no-cache -t <repo>:<tag> .

# Build with target stage (multi-stage)
docker build --target builder -t <repo>:<tag> .

# Build with secret (BuildKit)
DOCKER_BUILDKIT=1 docker build --secret id=mysecret,src=secret.txt -t <repo>:<tag> .

# Build with SSH forwarding (BuildKit)
DOCKER_BUILDKIT=1 docker build --ssh default -t <repo>:<tag> .

# Install buildx (included with Docker Desktop; on Linux, install the plugin)
docker buildx version

# Create a new builder with multi-platform support
docker buildx create --name multiplatform --driver docker-container --use

# Bootstrap the builder
docker buildx inspect --bootstrap

# Build for multiple platforms and push to a registry
docker buildx build --platform linux/amd64,linux/arm64,linux/arm/v7 \
  -t <repo>:<tag> --push .

# Build for a single foreign platform (load into local daemon)
docker buildx build --platform linux/arm64 -t <repo>:<tag> --load .

# Build with cache export/import (speeds up CI pipelines)
docker buildx build --cache-from type=registry,ref=<repo>:cache \
  --cache-to type=registry,ref=<repo>:cache,mode=max \
  -t <repo>:<tag> --push .

# List builders
docker buildx ls

# Remove a builder
docker buildx rm multiplatform

# Create a user-defined bridge
docker network create mynet

# Start two containers on the same network
docker run -d --name web --network mynet nginx
docker run -d --name app --network mynet myapp

# 'app' can reach 'web' by name
docker exec app ping web

# Run a container with a specific IP on a custom network
docker network create --subnet=172.20.0.0/16 mynet
docker run -d --name db --network mynet --ip 172.20.0.10 postgres

# Connect a running container to an additional network
docker network connect mynet existing-container

# Expose ports to the host
docker run -d -p 8080:80 nginx              # Map host 8080 to container 80
docker run -d -p 127.0.0.1:8080:80 nginx    # Bind to localhost only
docker run -d -p 8080:80/udp nginx           # UDP port mapping

# Publish a range of ports
docker run -d -p 8000-8010:8000-8010 myapp

# Container-to-container without publishing ports
# (containers on the same user-defined network can communicate on any port)

# Hard memory limit (container is killed if exceeded)
docker run -d --memory=512m <image>

# Memory + swap limit (total; set equal to --memory to disable swap)
docker run -d --memory=512m --memory-swap=512m <image>

# Soft limit (reservation, used for scheduling decisions)
docker run -d --memory=512m --memory-reservation=256m <image>

# Kernel memory limit
docker run -d --memory=512m --kernel-memory=50m <image>

# OOM kill disable (use with caution)
docker run -d --memory=512m --oom-kill-disable <image>

# Limit to specific number of CPUs
docker run -d --cpus=1.5 <image>

# CPU shares (relative weight, default 1024)
docker run -d --cpu-shares=512 <image>

# Pin to specific CPU cores
docker run -d --cpuset-cpus="0,2" <image>

# CPU period and quota (fine-grained control)
docker run -d --cpu-period=100000 --cpu-quota=50000 <image>

# Limit block I/O weight (10-1000, default 500)
docker run -d --blkio-weight=300 <image>

# Limit read/write bandwidth
docker run -d --device-read-bps /dev/sda:10mb --device-write-bps /dev/sda:10mb <image>

# Limit number of PIDs
docker run -d --pids-limit=100 <image>

# Set ulimits
docker run -d --ulimit nofile=1024:2048 --ulimit nproc=512 <image>

# GPU access (requires NVIDIA Container Toolkit)
docker run -d --gpus all <image>
docker run -d --gpus '"device=0,1"' <image>

# Live stats for all containers
docker stats

# One-shot stats (no streaming)
docker stats --no-stream

# Format output
docker stats --format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}"

# Check resource limits on a running container
docker inspect -f '{{.HostConfig.Memory}}' <container>

# Backup a named volume to a tar archive
docker run --rm -v <volume_name>:/source -v $(pwd):/backup busybox \
  tar czf /backup/backup.tar.gz -C /source .

# Backup using --volumes-from (copies all volumes from a container)
docker run --rm --volumes-from <container> -v $(pwd):/backup busybox \
  tar czf /backup/backup.tar.gz <container_path>

# Restore a named volume from a tar archive
docker run --rm -v <volume_name>:/target -v $(pwd):/backup busybox \
  sh -c "cd /target && tar xzf /backup/backup.tar.gz"

# Save one or more images to a tar archive
docker save -o images.tar <image1>:<tag> <image2>:<tag>

# Load images from a tar archive
docker load -i images.tar

# Run netshoot for comprehensive network debugging
docker run --rm -it --network container:<target_container> nicolaka/netshoot

# Test DNS resolution inside a container
docker exec <container> nslookup <hostname>

# Check container network configuration
docker exec <container> ip addr
docker exec <container> ip route

# Inspect bridge network details
docker network inspect bridge

# Capture traffic on a container's network
docker run --rm -it --net container:<target_container> nicolaka/netshoot tcpdump -i eth0

# Test connectivity between containers
docker exec <container_a> ping <container_b>