Docker

docker context show                 # which daemon the CLI targets (local socket, remote host, Desktop VM)
docker ps -a                        # status, exit code, published ports
docker logs --tail 100 my-app       # stdout/stderr of PID 1 only
docker inspect -f '{{.State.Status}} {{.State.ExitCode}} {{.State.OOMKilled}}' my-app

exited 137 true

docker run -d --name my-app \
  -p 127.0.0.1:8080:80 \
  -e DB_HOST=db \
  -v my-data:/app/data \
  --memory 512m --cpus 1.5 \
  --restart unless-stopped \
  nginx:1.30-alpine

docker stop my-app                  # SIGTERM to PID 1, SIGKILL after 10 s
docker stop -t 30 my-app            # allow 30 s to drain
docker start my-app                 # same filesystem and config, new process
docker rm -f my-app                 # kill and remove; the container layer is lost
docker update --memory 1g --restart on-failure:5 my-app

docker pull nginx:1.30-alpine
docker image ls
docker history my-app:1.0                                  # per-layer size and the instruction that made it
docker image inspect -f '{{.Config.Entrypoint}} {{.Config.Cmd}} {{.Config.User}}' my-app:1.0
docker tag my-app:1.0 registry.example.com/my-app:1.0
docker push registry.example.com/my-app:1.0
docker buildx imagetools inspect nginx:1.30-alpine         # digest and platforms without pulling

FROM golang:1.26-alpine AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download                          # cached until the manifests change
COPY . .
RUN CGO_ENABLED=0 go build -trimpath -o /out/server .

FROM alpine:3.24
RUN apk add --no-cache ca-certificates && adduser -S -u 10001 app
COPY --from=build /out/server /usr/local/bin/server
USER app
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=3s --retries=3 CMD wget -qO- http://127.0.0.1:8080/health || exit 1
ENTRYPOINT ["server"]
CMD ["--port", "8080"]

# syntax=docker/dockerfile:1
FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS base   # run the compiler on the build host's architecture
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download

FROM base AS test
COPY . .
RUN go vet ./... && go test ./...

FROM base AS build
ARG TARGETOS TARGETARCH                        # set automatically by buildx per platform
COPY . .
RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -trimpath -ldflags='-s -w' -o /out/server .

FROM gcr.io/distroless/static-debian12:nonroot AS runtime
COPY --from=build --chown=nonroot:nonroot /out/server /server
ENTRYPOINT ["/server"]

FROM runtime AS debug                          # same binary plus a shell, for docker exec
COPY --from=busybox:1.37-uclibc /bin/busybox /bin/busybox

docker build --target test .                        # run the tests stage only; fails the build on failure
docker build --target debug -t my-app:debug .       # image with a shell
docker build -t my-app:1.0 .                        # last stage: runtime
docker build --build-arg GOFLAGS=-mod=vendor .      # ARG values; unset ARGs take the Dockerfile default
docker buildx build --platform linux/amd64,linux/arm64 -t my-app:1.0 --push .   # cross-compile without QEMU thanks to $BUILDPLATFORM
docker build --no-cache-filter build .              # rebuild one stage, keep the cache for the others
docker build --progress=plain . 2>&1 | tail -50     # full RUN output instead of the collapsed view

# syntax=docker/dockerfile:1
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    go build -o /out/server .

RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && apt-get install -y --no-install-recommends ca-certificates

RUN --mount=type=cache,target=/root/.npm npm ci --prefer-offline
RUN --mount=type=cache,target=/root/.cache/pip pip install -r requirements.txt   # do not use --no-cache-dir with a cache mount
RUN --mount=type=cache,target=/root/.cache/uv,uid=10001 uv sync --frozen         # uid for a non-root build user

RUN --mount=type=bind,source=go.sum,target=go.sum,readonly go mod verify   # file from the context without a COPY layer
RUN --mount=type=ssh git clone git@git.example.com:org/private.git          # with: docker build --ssh default .
RUN --mount=type=secret,id=netrc,target=/root/.netrc curl -fsS https://internal.example.com/artifact

docker buildx build --cache-to type=registry,ref=registry.example.com/my-app:buildcache,mode=max \
                    --cache-from type=registry,ref=registry.example.com/my-app:buildcache -t my-app:1.0 --push .
docker buildx build --cache-to type=gha,mode=max --cache-from type=gha .    # GitHub Actions cache backend
docker buildx build --cache-to type=local,dest=/var/cache/buildkit --cache-from type=local,src=/var/cache/buildkit .
docker buildx build --output type=local,dest=./out --target build .          # export files instead of an image
docker buildx du && docker buildx prune --keep-storage 10GB                  # what the builder holds

HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --start-interval=5s --retries=3 \
  CMD ["/server", "healthcheck"]                 # exec form: no shell needed in the image; exit 0 healthy, 1 unhealthy
HEALTHCHECK NONE                                  # disable one inherited from the base image

docker run -d --health-cmd 'curl -fsS http://127.0.0.1:8080/health || exit 1' --health-interval 10s --health-retries 3 --health-start-period 30s my-app
docker run -d --no-healthcheck my-app             # ignore the image's HEALTHCHECK
docker inspect -f '{{.State.Health.Status}}' my-app
docker inspect -f '{{range .State.Health.Log}}{{.End}} {{.ExitCode}} {{.Output}}{{end}}' my-app   # last five results with output
docker ps --filter health=unhealthy
docker events --filter event=health_status        # health_status: healthy / unhealthy transitions

docker run -d --log-driver local --log-opt max-size=20m --log-opt max-file=5 my-app
docker run -d --log-driver journald --log-opt tag='{{.Name}}' my-app
docker run -d --log-opt mode=non-blocking --log-opt max-buffer-size=4m my-app   # drop logs rather than block the app if the driver stalls
docker inspect -f '{{.HostConfig.LogConfig.Type}} {{.HostConfig.LogConfig.Config}}' my-app
docker inspect -f '{{.LogPath}}' my-app                                     # the file json-file or local writes
sudo du -sh /var/lib/docker/containers/*/*-json.log | sort -h | tail        # who is filling the disk

{
  "log-driver": "local",
  "log-opts": { "max-size": "20m", "max-file": "5" }
}

docker run -d --memory 512m --memory-swap 512m my-app     # hard limit, no swap (swap = memory-swap - memory)
docker run -d --memory 512m --memory-reservation 256m my-app   # soft target used under host pressure
docker run -d --cpus 1.5 my-app                           # CFS quota: 1.5 CPUs per period; throttled above that
docker run -d --cpu-shares 512 my-app                     # relative weight under contention only (default 1024)
docker run -d --cpuset-cpus 2-3 my-app                    # pin to CPUs 2 and 3
docker run -d --pids-limit 256 my-app                     # fork-bomb protection
docker run -d --ulimit nofile=65536:65536 --ulimit nproc=4096 my-app
docker run -d --shm-size 1g my-app                        # /dev/shm, 64 MB by default; browsers and PostgreSQL need more
docker run -d --device-read-bps /dev/sda:50mb --device-write-iops /dev/sda:1000 my-app
docker update --memory 1g --memory-swap 1g --cpus 2 my-app   # live change; memory-swap must be updated with memory
docker stats --no-stream --format 'table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.MemPerc}}\t{{.PIDs}}'
docker exec my-app cat /sys/fs/cgroup/cpu.stat /sys/fs/cgroup/memory.max /sys/fs/cgroup/memory.events   # throttling and OOM counters from inside

docker run -d --user 10001:10001 my-app                    # never rely on the image's USER when you did not build it
docker run -d --read-only --tmpfs /tmp:rw,noexec,nosuid,size=64m -v my-data:/app/data my-app
docker run -d --cap-drop ALL --cap-add NET_BIND_SERVICE my-app
docker run -d --security-opt no-new-privileges:true my-app  # setuid binaries and file capabilities cannot raise privileges
docker run -d --security-opt seccomp=/etc/docker/seccomp/my-app.json my-app   # custom syscall allowlist; default profile blocks ~44 syscalls
docker run -d --security-opt apparmor=docker-default my-app # Debian/Ubuntu; SELinux hosts label containers as container_t automatically
docker run -d --security-opt label=type:my_container_t my-app   # custom SELinux type (Fedora/RHEL, needs a policy module)
docker run -d --security-opt label=disable -v /var/log:/host/log:ro my-app   # skip SELinux labelling for one container; prefer :z or :Z
docker run -d --userns=host my-app                          # opt out of daemon-level user namespace remapping for one container
docker run -d --pull always registry.example.com/my-app@sha256:...   # pin the digest and refuse a stale local copy
docker inspect -f '{{.HostConfig.Privileged}} {{.HostConfig.CapAdd}} {{.HostConfig.SecurityOpt}} {{.Config.User}}' my-app
docker container ls -q | xargs docker inspect -f '{{.Name}} privileged={{.HostConfig.Privileged}} user={{.Config.User}}'

docker volume create my-data
docker run -d -v my-data:/var/lib/postgresql/data postgres:17   # named volume
docker run -v "$PWD/src:/app/src:ro,Z" my-app                   # bind mount, read-only, SELinux relabel
docker run --mount type=tmpfs,destination=/tmp my-app           # memory-backed scratch
docker volume inspect my-data                                   # Mountpoint on the host
docker volume ls -f dangling=true                               # not attached to any container

docker run --rm -v my-data:/data:ro -v "$PWD:/backup" alpine:3.24 tar czf /backup/my-data.tgz -C /data .

docker network create my-net
docker run -d --network my-net --name db postgres:17
docker run --rm --network my-net alpine:3.24 getent hosts db   # prints the container IP
docker network connect my-net my-app                            # attach a running container
docker network inspect my-net -f '{{json .Containers}}'
docker port my-app                                              # published port mappings

docker logs -f --since 15m --timestamps my-app
docker exec -it my-app sh                           # bash on Debian/Ubuntu-based images
docker exec my-app ps -eo pid,comm,rss              # what is actually running
docker stats --no-stream                            # CPU, memory, network and block I/O per container
docker top my-app                                   # host-side view of the container's processes
docker diff my-app                                  # files added (A), changed (C) or deleted (D) since start
docker events --since 10m --filter container=my-app # die, oom, kill and health_status events

docker run --rm -it --pid container:my-app --network container:my-app --cap-add SYS_PTRACE nicolaka/netshoot

printf '%s' "$REGISTRY_TOKEN" | docker login registry.example.com -u alice --password-stdin
docker buildx build --platform linux/amd64,linux/arm64 -t registry.example.com/my-app:1.0 --push .

docker system df -v                                 # what is using the space, per object
docker container prune                              # stopped containers
docker image prune                                  # dangling (untagged) images
docker image prune -a --filter "until=168h"         # every image not used by a container, older than 7 days
docker builder prune --keep-storage 10GB            # trim BuildKit cache, often the largest item
docker system prune                                 # stopped containers, unused networks, dangling images, build cache

# Stop every running container
docker stop $(docker ps -q)

# Remove every exited container
docker rm $(docker ps -aq -f status=exited)

# Every container's IP on every network
docker inspect -f '{{.Name}} {{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}' $(docker ps -q)

# Images sorted by size
docker image ls --format '{{.Size}}\t{{.Repository}}:{{.Tag}}' | sort -h -r | head

# Environment of a running container (may print secrets)
docker inspect -f '{{range .Config.Env}}{{println .}}{{end}}' my-app

# Which container publishes port 8080
docker ps --format '{{.Names}}\t{{.Ports}}' | grep ':8080->'

# Wait until a health check passes
until [ "$(docker inspect -f '{{.State.Health.Status}}' my-app)" = healthy ]; do sleep 1; done

# Containers with their restart policy and restart count (spot crash loops)
docker ps -a --format '{{.Names}}' | xargs docker inspect -f '{{.Name}} {{.HostConfig.RestartPolicy.Name}} restarts={{.RestartCount}} {{.State.Status}}'

# Containers running as root
docker ps -q | xargs docker inspect -f '{{.Name}} user={{.Config.User}}' | awk '$2 == "user=" || $2 == "user=root" || $2 == "user=0"'

# Containers with no memory limit
docker ps -q | xargs docker inspect -f '{{.Name}} {{.HostConfig.Memory}}' | awk '$2 == 0'

# Memory usage against limit, sorted
docker stats --no-stream --format '{{.MemPerc}}\t{{.MemUsage}}\t{{.Name}}' | sort -rn | head

# Containers with a mounted Docker socket (root-equivalent)
docker ps -q | xargs docker inspect -f '{{.Name}} {{range .Mounts}}{{.Source}} {{end}}' | grep docker.sock

# Digest a container is actually running, for comparison with the registry
docker inspect -f '{{.Image}}' my-app | xargs docker image inspect -f '{{index .RepoDigests 0}}'

# Log size per container
sudo sh -c 'for f in /var/lib/docker/containers/*/*-json.log; do printf "%s %s\n" "$(du -m "$f" | cut -f1)" "$(basename "$(dirname "$f")" | cut -c1-12)"; done' | sort -rn | head

# Resolve a short container ID to a name
docker ps -a --no-trunc --format '{{.ID}} {{.Names}}' | grep '^abc123'

# Export an image as a tarball and import it on an offline host
docker save my-app:1.0 | zstd -T0 > my-app-1.0.tar.zst;  zstd -dc my-app-1.0.tar.zst | docker load

# Flatten the filesystem of a container into a plain tar (no history, no metadata)
docker export my-app | tar -tvf - | head

# Build with full logs and keep the failing layer's state for inspection
docker build --progress=plain --target build . 2>&1 | tee build.log

# List the files a Dockerfile stage would produce, without creating an image
docker buildx build --target build --output type=tar,dest=- . | tar -tvf - | head -40

# Layers of an image with the command that created each, largest first
docker history --no-trunc --format '{{.Size}}\t{{.CreatedBy}}' my-app:1.0 | sort -h -r | head

# Compare the packages installed in two image versions (Debian-based)
diff <(docker run --rm my-app:1.0 dpkg-query -W) <(docker run --rm my-app:1.1 dpkg-query -W)

# Run a one-off command in the same network as a container, with a tools image
docker run --rm --network container:my-app nicolaka/netshoot curl -sS http://127.0.0.1:8080/health

# Copy a file into a running container without docker cp (works with read-only root if the target is a volume)
tar -cf - config.yaml | docker exec -i my-app tar -xf - -C /app/data

# Follow logs from several containers with names prefixed
docker compose logs -f 2>/dev/null || for c in web worker; do docker logs -f --tail 20 "$c" 2>&1 | sed "s/^/[$c] /" & done; wait

# Events for the last hour as JSON lines: OOMs, restarts, health flips
docker events --since 1h --until "$(date +%s)" --format '{{json .}}' | jq -r 'select(.status | IN("oom", "die", "health_status: unhealthy")) | [.time, .status, .Actor.Attributes.name] | @tsv'

# Dangling volumes with their size
docker system df -v | awk '/^VOLUME NAME/{f=1; next} f && $2 == 0 {print $1, $3}'

# Remove images older than 30 days that no container uses
docker image prune -a --filter 'until=720h' --force

# Check whether the daemon is on cgroup v2 and which storage driver it uses
docker info --format '{{.CgroupVersion}} {{.Driver}} {{.LoggingDriver}}'

#!/usr/bin/env bash
# usage: docker-audit.sh [container...]   default: all running containers
set -euo pipefail

mapfile -t ids < <(if (( $# )); then printf '%s\n' "$@"; else docker ps -q; fi)
(( ${#ids[@]} )) || { echo 'no containers'; exit 0; }
findings=0
note() { printf '%-28s %s\n' "$1" "$2"; (( findings++ )) || true; }

for id in "${ids[@]}"; do
  j=$(docker inspect "$id")
  name=$(jq -r '.[0].Name | ltrimstr("/")' <<< "$j")
  jq -e '.[0].HostConfig.Privileged' <<< "$j" >/dev/null && note "$name" 'privileged'
  [[ $(jq -r '.[0].HostConfig.NetworkMode' <<< "$j") == host ]] && note "$name" 'host network'
  [[ $(jq -r '.[0].HostConfig.PidMode' <<< "$j") == host ]] && note "$name" 'host PID namespace'
  jq -e '.[0].Mounts[] | select(.Source | test("docker.sock$"))' <<< "$j" >/dev/null && note "$name" 'docker socket mounted'
  [[ $(jq -r '.[0].Config.User' <<< "$j") =~ ^(|root|0|0:0)$ ]] && note "$name" 'runs as root'
  [[ $(jq -r '.[0].HostConfig.Memory' <<< "$j") == 0 ]] && note "$name" 'no memory limit'
  [[ $(jq -r '.[0].HostConfig.PidsLimit // 0' <<< "$j") == 0 ]] && note "$name" 'no pids limit'
  jq -e '.[0].HostConfig.CapAdd // [] | index("SYS_ADMIN")' <<< "$j" >/dev/null && note "$name" 'CAP_SYS_ADMIN added'
  jq -e '.[0].State.Health == null' <<< "$j" >/dev/null && note "$name" 'no healthcheck'
  if [[ $(jq -r '.[0].HostConfig.LogConfig.Type' <<< "$j") == json-file ]] && ! jq -e '.[0].HostConfig.LogConfig.Config["max-size"]' <<< "$j" >/dev/null; then
    note "$name" 'json-file logging without max-size'
  fi
done
printf '%d findings across %d containers\n' "$findings" "${#ids[@]}"
(( findings == 0 ))

#!/usr/bin/env bash
# usage: volume-backup.sh [--stop] DEST_DIR
set -euo pipefail

stop=0
[[ ${1:-} == --stop ]] && { stop=1; shift; }
dest=${1:?destination directory}
mkdir -p "$dest"
stamp=$(date +%Y%m%dT%H%M%S)

while IFS= read -r vol; do
  mapfile -t running < <(docker ps -q --filter "volume=$vol")
  if (( ${#running[@]} )); then
    if (( stop )); then docker stop "${running[@]}" >/dev/null; else printf 'skip %s: in use by running container(s)\n' "$vol" >&2; continue; fi
  fi
  out=$dest/$vol-$stamp.tar.zst
  docker run --rm -v "$vol:/data:ro" -v "$dest:/backup" alpine:3.24 \
    sh -c 'apk add --no-cache zstd >/dev/null && tar -C /data -cf - . | zstd -T0 -q > "/backup/$0"' "$(basename "$out")"
  printf '%s %s\n' "$(du -h "$out" | cut -f1)" "$out"
  if (( ${#running[@]} && stop )); then docker start "${running[@]}" >/dev/null; fi
done < <(docker volume ls -q --filter dangling=false; docker volume ls -q --filter dangling=true)

#!/usr/bin/env bash
# usage: image-drift.sh
set -euo pipefail

printf '%-30s %-45s %-8s %s\n' CONTAINER IMAGE AGE STATUS
for id in $(docker ps -q); do
  name=$(docker inspect -f '{{.Name}}' "$id"); name=${name#/}
  ref=$(docker inspect -f '{{.Config.Image}}' "$id")
  local_digest=$(docker inspect -f '{{.Image}}' "$id" | xargs docker image inspect -f '{{if .RepoDigests}}{{index .RepoDigests 0}}{{end}}' | sed 's/.*@//')
  created=$(docker inspect -f '{{.Image}}' "$id" | xargs docker image inspect -f '{{.Created}}')
  age=$(( ($(date +%s) - $(date -d "$created" +%s)) / 86400 ))d
  if [[ $ref == *@sha256:* ]]; then status=pinned
  elif remote=$(timeout 20 docker buildx imagetools inspect "$ref" --format '{{json .Manifest.Digest}}' 2>/dev/null | tr -d '"'); then
    [[ $remote == "$local_digest" ]] && status=current || status="STALE (registry $remote)"
  else status='registry unreachable'; fi
  printf '%-30s %-45s %-8s %s\n' "$name" "$ref" "$age" "$status"
done