Skip to main content
Kill -9 Club
Sign in

docker

ContainersPackage: docker-ce-cliHandle with care

Builds and runs containers. docker ps, docker logs and docker exec are the troubleshooting trio; docker compose describes several containers in a file rather than in a two-hundred-character command line.

A mistake with this command can destroy data or lock you out

  • docker system prune -a --volumes and docker rm -v destroy volumes, hence data. And a port Docker publishes is open from outside even where ufw refuses it: Docker writes its own rules ahead of ufw's.

What its options do in the lessons

From the same glossary the lessons render under their commands, so the two cannot disagree.

docker -d
Detached: the container runs in the background.
docker -i
Keeps standard input open.
docker -t
Allocates a pseudo-terminal. -it together give an interactive session.
docker -a
With docker ps, includes stopped containers.
docker -p
Publishes a container port on the host (-p 127.0.0.1:5432:5432). Naming the address keeps the service off the whole network.
docker -v
Mounts a volume or a host directory inside the container.
docker --name
Names the container, instead of the random name assigned by default.
docker --rm
Removes the container as soon as it exits, so dead containers do not pile up.
docker --memory
The maximum memory the container may use (--memory=512m). The smallest accepted value is 6m. At the ceiling the OOM killer is invoked inside the container cgroup, not on the host.
docker --cpus
How much CPU the container gets. On a host with two CPUs, --cpus=1.5 allows it at most one and a half. Going over makes the container wait; it does not kill it.
docker --no-stream
On docker stats, prints one sample and exits instead of refreshing continuously. The form to use in a script or to paste into a ticket.
docker --format
A Go template rather than the full record: docker inspect --format '{{.State.ExitCode}}' returns only the field you asked for.
docker --filter
Restricts the list to what matches. docker ps -a --filter 'exited=137' shows only containers ended by SIGKILL.
docker compose -d
Detached: the services run in the background.
docker compose -f
Which compose file to use, when it is not the one in the current directory.
docker compose --build
Rebuilds the images before starting.
docker compose -v
On down, also removes the project’s named volumes, and therefore the data. The one option in this lesson that destroys something unrecoverable.
docker compose -q
Prints only container IDs, one per line, instead of the full table. Useful for comparing the ID before and after an up -d to tell whether the container was really recreated.
docker --password-stdin
Reads the password from standard input instead of taking it as an argument. The secret therefore never passes through the shell's history or the process list, where ps would hand it to any user on the machine.
docker -u
Names the account to authenticate with against the registry. On a server that is a robot account or a deploy token, never a person's account.

Lessons that teach it