Docker Cheatsheet

# Base image
FROM ubuntu:22.04

# Labels
LABEL maintainer="user@example.com"
LABEL version="1.0"

# Arguments (build-time only)
ARG DEBIAN_FRONTEND=noninteractive
ARG APP_VERSION=1.0

# Environment variables (persist at runtime)
ENV APP_HOME=/app
ENV PATH="${APP_HOME}/bin:${PATH}"

# Working directory
WORKDIR /app

# Install packages
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        curl \
        ca-certificates && \
    rm -rf /var/lib/apt/lists/*

# Copy files
COPY package.json package-lock.json ./
COPY src/ ./src/

# Add files (supports URLs and auto-extracts tarballs)
ADD https://example.com/app.tar.gz /tmp/

# Run commands (needs Node in the image; --omit=dev replaces the old --production)
RUN npm ci --omit=dev

# Expose ports (documentation only)
EXPOSE 3000

# Create non-root user
RUN useradd -r -s /bin/false appuser
USER appuser

# Health check
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
    CMD curl -f http://localhost:3000/health || exit 1

# Default command
CMD ["node", "src/index.js"]

# Alternative: entrypoint + cmd (use one or the other: with two CMD lines only the last counts,
# and the build warns "Multiple CMD instructions should not be used in the same stage")
# ENTRYPOINT ["node"]
# CMD ["src/index.js"]

# Build stage
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# Production stage
FROM node:20-alpine
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
EXPOSE 3000
USER node
CMD ["node", "dist/index.js"]

# Login to the container registry (username + access token)
docker login gitea.example.com
echo "$GITEA_TOKEN" | docker login gitea.example.com -u <username> --password-stdin

# build an image with tag
docker build -t gitea.example.com/<owner>/<image>:<tag> .

# name an existing image with tag
docker tag <some-existing-image>:<tag> gitea.example.com/<owner>/<image>:<tag>

# Push an image
docker push gitea.example.com/<owner>/<image>:<tag>

# Pull (anonymous for public users and organizations; login needed for private ones)
docker pull gitea.example.com/<owner>/<image>:<tag>

curl -s -u "<username>:$GITEA_TOKEN" "https://gitea.example.com/api/v1/packages/<owner>?type=container" | jq -r '.[] | "\(.name):\(.version)"'

docker system df          # disk usage per type
docker system df -v       # per image, container and volume
docker info               # daemon info
docker version            # client and server versions

docker run -d --memory=512m --memory-swap=1g --cpus=1.5 --pids-limit 100 myapp

# Check all containers for specific labels (e.g., Traefik)
for container in $(docker ps -q); do
    name=$(docker inspect --format '{{.Name}}' $container | sed 's/\///')
    echo "=== $name ==="
    docker inspect $container | grep -i traefik | head
done

# Find images by layer hash
for I in $(docker image ls --format '{{.ID}}'); do
    F=$(docker image inspect $I | grep "<hash>")
    if [ -n "$F" ]; then echo $I; fi
done

# Find volumes by ID/hash
for I in $(docker volume ls | grep -v DRIVER | awk '{print $2}' | sort | uniq); do
    F=$(docker volume inspect $I | grep "${ID}")
    if [ -n "$F" ]; then echo $I; fi
done

# Find containers by ID/hash
for I in $(docker container ls --no-trunc | grep -v CONTAINER | awk '{print $1}' | sort | uniq); do
    F=$(docker container inspect $I | grep "${ID}")
    if [ -n "$F" ]; then echo $I; fi
done

docker run -d --restart unless-stopped myapp
docker update --restart on-failure:3 myapp      # change it on an existing container

# Run with restart policy and health check
docker run -d \
    --restart unless-stopped \
    --health-cmd="curl -f http://localhost:8080/health || exit 1" \
    --health-interval=30s \
    -p 80:8080 \
    myapp:prod

# Resource-limited production container
docker run -d \
    --restart unless-stopped \
    --memory=512m \
    --cpus=1.0 \
    --read-only \
    --tmpfs /tmp \
    --cap-drop ALL \
    --security-opt no-new-privileges \
    -p 8080:8080 \
    myapp:prod

alias dps='docker ps'
alias dpsa='docker ps -a'
alias dimg='docker images'
alias dlog='docker logs -f'
alias dstart='docker start $(docker ps -aq)'
alias dstop='docker stop $(docker ps -aq)'
alias drm='docker rm $(docker ps -aq)'
alias dri='docker rmi $(docker images -q)'
alias dprune='docker system prune -af --volumes'

dbash() {
    docker exec -it $(docker ps -aqf "name=$1") bash
}
# Usage: dbash mycontainer

# Find Docker root directory
docker info --format '{{ .DockerRootDir }}'

# View daemon configuration
cat /etc/docker/daemon.json

# Example daemon.json
# {
#   "log-driver": "json-file",
#   "log-opts": { "max-size": "10m", "max-file": "3" },
#   "storage-driver": "overlay2",
#   "default-address-pools": [{ "base": "172.17.0.0/12", "size": 24 }]
# }

docker build -t myapp:latest -t myapp:v1.0 -t myapp:$(git rev-parse --short HEAD) .

# .dockerignore — exclude from build context
.git
.gitignore
node_modules
npm-debug.log
.env
.DS_Store
*.md
docker-compose*.yml
Dockerfile*

docker run -d --pid=host --ipc=host --uts=host nginx

# Run tests in a disposable container
docker run --rm \
    -v $(pwd):/app \
    -w /app \
    node:20 \
    npm test

# Run with specific env
docker run --rm \
    -v $(pwd):/app \
    -w /app \
    -e CI=true \
    -e NODE_ENV=test \
    node:20 \
    npm run test:coverage