Docker and Docker Swarm command guide

Turn a Dockerfile and a build context into an image.

Build for another architecture, or for several at once.

List local images, with size and age.

Give an existing image another name — how an image becomes pushable.

Fetch an image from a registry before you need it.

Upload a tagged image to its registry.

See which layer made the image big.

Move an image between machines without a registry.

Reclaim the disk that old builds are sitting on.

Create a container from an image and start it.

List running containers — and, with -a, the ones that died.

Run a command inside a container that is already running.

Read what the container wrote to stdout and stderr.

Stop politely, start again, or do both.

Delete a stopped container (and optionally its anonymous volumes).

Every detail of a container, image, volume, network or service — as JSON.

Copy files in or out of a container, running or not.

Live CPU, memory, network and disk per container.

What happens after a crash, and after a reboot.

Stop one container from taking the whole host down with it.

The base image every other instruction builds on.

Execute a command at build time; each one is a layer.

Use COPY. ADD does surprising extra things.

What runs, and what a user can override.

ARG is build time only; ENV is in the running container, forever.

Document the port; set the directory everything else runs in.

Drop privileges in the image, not in an entrypoint script.

Let Docker know whether the process is actually serving.

Build with a full toolchain, ship only the result.

Keep the build context small — and secrets out of the image.

Put what changes least at the top; the cache does the rest.

A private-registry token or SSH key without leaving it in the image.

Three ways to keep data out of the container layer, for three different jobs.

Manage named volumes directly.

Edit on the host, the container sees it immediately.

Get the data out with a throwaway container.

Delete volumes nothing is using — carefully.

Make a container port reachable from outside the host.

A private network so containers can find each other by name.

On a user-defined network, the container name is the hostname.

The three single-host network modes, and when host is worth it.

One private network spanning every node in the Swarm.

Any node answers on a published port, wherever the task runs.

Start everything in the compose file, creating what is missing.

Stop and remove the containers and network — and, if you insist, the data.

Interleaved logs for the whole project, or one service.

A shell in a running service, or a one-off container of it.

Build the services that have a build section; pull the ones that do not.

Print the file as Compose actually understands it.

Three different things called environment, and which one wins.

Start order is not readiness — wait for healthy.

One production-shaped base file, plus what differs per environment.

Keep optional services in the file without starting them every time.

The same file, two engines — and the keys each one ignores.

Turn this machine into a one-node cluster you can grow.

Add this machine to an existing cluster, as a worker or a manager.

Print (or rotate) the token new nodes join with.

Who is in the cluster, what role, and are they healthy.

Drain a node before maintenance; make it active again after.

Change a worker into a manager, or back.

Lose more than half the managers and the cluster stops accepting changes.

Take a node out of the cluster properly.

Tag nodes, then pin services to the right ones.

Run something on the cluster and keep it running.

Every service, and whether it has as many replicas as it should.

The tasks of a service — where they run, and why they failed.

Change the replica count of a running service.

Change a running service — image, env, ports, limits — without downtime.

How fast to replace tasks, and what to do when one fails.

Go back to the previous spec — the fastest fix in a bad deploy.

Logs from every task of a service, whichever node they run on.

n copies somewhere, or exactly one on every node.

Where a task may run, and how replicas should be spread.

Limits cap a task; reservations decide whether it gets scheduled at all.

Attach a volume, bind or tmpfs to every task.

Delete a service and stop all its tasks.

The full spec of a service — what the cluster thinks it should be running.

Apply a compose file to the Swarm — the declarative deploy.

Everything Swarm-specific lives under deploy: in the compose file.

Which stacks exist, and every task inside one.

Replica counts and images for one stack.

Remove every service and network of a stack.

Store a credential in the cluster, encrypted, out of the image.

Mount it as a file and point the app at the path.

Secrets are immutable, so rotation is add-then-swap.

Ship a configuration file to tasks without baking it into the image.

Env vars leak into inspect, logs, crash dumps and child processes.

Authenticate to a registry before pulling or pushing private images.

The flag that stops a private image failing on every node but one.

A tag is a moving pointer; a digest is the bytes.

A tag that means "whatever was pushed most recently" is not a version.

A private registry inside the cluster, so every node can pull.

What is actually using the disk.

Reclaim everything unused — read the flags before you press enter.

Find it, free it, stop it happening again.

The default json-file driver never rotates. Set a cap once, per host.

137 is a kill, 143 is a graceful stop, 1 is the app.

A live stream of what the daemon is doing.

Replicas stuck at 0/3 or a rolling update that never finishes.

The scheduler had nowhere to put the task — and it says why.

distroless and scratch images have nothing to exec into.

Containers are not a security boundary you should lean on.

Why a stop takes ten seconds and then kills your app.

An arm64 image on an amd64 server, or the other way round.

A task that moves node finds an empty volume — and the data is still on the old one.

The cluster does not know about it, and will not look after it.