Toolbox · Containers
Docker Commands
Build, run, inspect and clean up containers and images, with the flags that matter for security.
On this page
Build
| Command | Purpose |
|---|---|
docker build --pull -t app:dev . | Build, refreshing the base image |
docker build --no-cache -t app:dev . | Ignore layer cache |
docker build --target build -t app:build . | Build a specific multi-stage target |
docker buildx build --platform linux/amd64,linux/arm64 -t reg/app:1.0 --push . | Multi-arch build and push |
docker buildx build --sbom=true --provenance=true … | Attach SBOM and provenance attestations |
RUN --mount=type=secret,id=npmrc … | Use a build secret without baking it into a layer |
Run
| Command | Purpose |
|---|---|
docker run --rm -it app:dev sh | Interactive shell, remove on exit |
docker run --rm --user 10001 --read-only --cap-drop ALL app:dev | Hardened runtime flags |
docker run --rm -p 8080:8080 --memory 512m --cpus 1 app:dev | Port and resource limits |
docker run --rm --network none app:dev | No network |
docker exec -it <ctr> sh | Shell into a running container |
Inspect
| Command | Purpose |
|---|---|
docker ps -a | All containers incl. exited |
docker logs -f --tail 100 <ctr> | Follow logs |
docker inspect <ctr> | jq '.[0].State' | State, exit code, OOM |
docker history --no-trunc app:dev | Layer commands (spot leaked args) |
docker image inspect app:dev --format '{{.Config.User}}' | Verify non-root user |
docker stats --no-stream | CPU/memory snapshot |
docker diff <ctr> | Files changed in the container FS |
Clean up
| Command | Purpose |
|---|---|
docker system df | Disk usage by type |
docker image prune -a --filter "until=168h" | Caution remove unused images older than 7 days |
docker container prune | Caution remove stopped containers and their filesystems |
docker builder prune | Clear build cache |
docker system prune -a --volumes | Destructive stopped containers, unused images and networks, build cache, anonymous volumes |