Command Reference & Compose Guide
# compose.yaml — annotated example services: web: image: nginx:alpine # use a pre-built image build: ./app # — or build from Dockerfile restart: unless-stopped ports: - "80:80" # host:container - "443:443" environment: - NODE_ENV=production - DB_HOST=db # service name = hostname volumes: - ./html:/usr/share/nginx/html:ro - data-vol:/data # named volume depends_on: - db networks: - frontend - backend healthcheck: test: ["CMD","curl","-f","http://localhost"] interval: 30s timeout: 10s retries: 3 db: image: postgres:16-alpine restart: unless-stopped environment: POSTGRES_PASSWORD: secret POSTGRES_DB: mydb volumes: - pg-data:/var/lib/postgresql/data networks: - backend volumes: data-vol: # managed by Docker pg-data: networks: frontend: backend: driver: bridge
no — never restartalways — always restartunless-stopped — restart unless manually stoppedon-failure — only on non-zero exitenv_file: .env to load variables from a file instead of listing them inline. Keep secrets out of compose.yaml.build: ./dir uses ./dir/Dockerfile. Use build.context + build.dockerfile for custom paths.profiles: [dev] and start them selectively with --profile dev.healthcheck + depends_on.condition: service_healthy for true readiness.namespaces (pid, net, mnt, uts, ipc) to isolate processes and cgroups to limit CPU/memory.created → running → paused → stopped → removed. A stopped container retains its writable layer until docker rm.nginx:alpine) are just human-readable aliases for a digest.FROM a parent. FROM scratch builds from nothing — used for minimal static binaries.amd64, arm64, etc. Docker pulls the right one automatically.docker rm and can be shared across multiple containers simultaneously.
docker volume create or declared in compose. Stored under /var/lib/docker/volumes/ on the host.-v ./src:/app) directly. Good for dev; less portable than named volumes.docker run./etc/hosts editing.-p 8080:80 binds host port 8080 to container port 80. Without it, the container is unreachable from outside Docker.FROM node:22-alpine — choose minimal tags for smaller images.&& to reduce layer count.COPY copies files from build context into the image. ADD also handles URLs and tar extraction (prefer COPY).ENTRYPOINT is the fixed executable; CMD provides default args. Together: ENTRYPOINT ["node"] + CMD ["server.js"].ENV sets runtime environment variables. ARG is build-time only — use for version pins, not secrets.FROM statements to separate build tools from the final image. Copy only artifacts between stages to keep images tiny.docker build is like following the recipe step-by-step in a kitchen to produce the final dish (image).docker pull downloads images from a registry; docker push uploads them. Docker Hub is the default public registry; private registries are common in production.
hub.docker.com. Images without a hostname prefix are pulled from here (e.g., nginx:alpine).[registry/][user/]name[:tag][@digest]. Tag defaults to latest. Digest pins to an exact immutable version.docker login registry.example.com stores credentials. Private images require authentication to pull.docker build. Order instructions by change frequency — least-changed first.FROM node:22 in 10 projects = one copy on disk.RUN apt-get update && apt-get install -y pkg && rm -rf /var/lib/apt/lists/* in one instruction to avoid bloated intermediate layers.docker history image shows each layer's size and instruction. docker image inspect image lists layer SHAs.docker-compose.yml format becomes the standard for local dev stacks.runc runtime as the OCI reference implementation.docker swarm init creates a production-grade cluster. Services, rolling updates, and load balancing are all built in.docker-compose to docker compose. Startup is 2–5× faster.