Docker Commands Cheat Sheet: The Ones You Actually Use

The Docker commands you'll use most are docker run to start a container, docker ps to list them, docker exec -it <name> sh to get a shell inside one, docker logs to read output, and docker stop and docker rm to shut down and delete. Everything else on this page builds on those five.

docker run -d --name web -p 8080:80 nginx   # start a container in the background
docker ps                                   # list running containers
docker logs -f web                          # follow its output
docker exec -it web sh                      # open a shell inside it
docker stop web && docker rm web            # stop and delete it

Command names and flags below match Docker 26.1 (docker --help, as of October 2026). Most commands have a long form too: docker run is an alias of docker container run, docker images of docker image ls, and so on. Both work.

Run a container: docker run

docker run creates a new container from an image and starts it, downloading the image first if it isn't on your machine. The flags that matter:

The port order trips people up: the host port comes first. -p 8080:80 means "connections to port 8080 on my machine go to port 80 in the container", so you'd open http://localhost:8080. If you get a "port is already allocated" error, something on the host already holds that port; how to fix "port already in use" shows how to find it.

Anything after the image name replaces the image's default command: docker run --rm python:3.12 python -c "print(1+1)" runs that one-liner and exits.

See what's running: docker ps

docker ps          # running containers
docker ps -a       # all containers, including stopped ones
docker ps -q       # IDs only, handy for scripting

The columns are container ID, image, command, created, status, ports and name. A container that exited immediately after docker run -d only shows up with -a, with a status like Exited (1); check its logs to see why.

Read output and get inside: logs, exec, cp

docker logs web              # everything the container has printed
docker logs -f web           # keep following new output (Ctrl+C to stop)
docker logs -n 50 web        # last 50 lines (--tail)
docker logs --since 10m web  # only the last 10 minutes

docker exec -it web sh       # interactive shell in a running container
docker exec web ls /etc      # run one command and return

docker cp web:/etc/nginx/nginx.conf .   # copy a file out of a container
docker cp ./site.conf web:/etc/nginx/conf.d/   # copy a file in

docker exec only works on a running container. Many small images (Alpine, distroless) don't include bash, so use sh if bash fails.

docker stats shows live CPU, memory and network use per container; docker stats --no-stream prints one snapshot. docker inspect web dumps the full configuration as JSON, including IP address, mounts and environment.

Stop, start and delete containers

docker stop web      # graceful stop
docker start web     # start the same container again
docker restart web
docker kill web      # immediate stop (SIGKILL by default)
docker rm web        # delete a stopped container
docker rm -f web     # stop and delete in one step

docker stop sends SIGTERM and, if the process hasn't exited after a grace period, SIGKILL. The Docker docs give the default grace period as 10 seconds for Linux containers and 30 seconds for Windows containers; change it with -t. A container that always takes the full 10 seconds to stop usually has a main process that ignores SIGTERM.

Deleting a container throws away any files written inside it that aren't on a volume. That's by design: containers are meant to be disposable, with data kept in volumes.

Images: pull, list, build, remove

docker pull postgres:16          # download an image
docker images                    # list local images
docker build -t myapp:1.0 .      # build from the Dockerfile in this folder
docker build -t myapp:1.0 -f docker/Dockerfile .   # Dockerfile elsewhere
docker build --no-cache -t myapp:1.0 .            # ignore cached layers
docker rmi myapp:1.0             # delete an image
docker tag myapp:1.0 registry.example.com/myapp:1.0
docker push registry.example.com/myapp:1.0

Always pin a tag (postgres:16, not just postgres). Without a tag Docker uses :latest by default, a tag that moves whenever the publisher pushes a new version. The . at the end of docker build is the build context: the folder whose files are sent to the builder and can be COPY'd into the image.

docker rmi refuses to remove an image that a container (even a stopped one) still uses. Remove the container first, or use -f.

Volumes and networks

docker volume create data
docker volume ls
docker volume inspect data
docker volume rm data

docker network create appnet
docker network ls
docker run -d --name db --network appnet postgres:16
docker run -d --name api --network appnet myapp:1.0

Containers on the same user-created network can reach each other by container name, so api can connect to the database at host db, port 5432, without publishing that port to your machine. This name lookup only works on networks you create; on the default bridge network, containers can reach each other only by IP address. Once you're starting more than two containers this way, a Compose file is easier to manage than a list of docker run commands: see Docker Compose explained.

Free up disk space: prune

docker system df                  # how much space images, containers, volumes and cache use
docker container prune            # remove all stopped containers
docker image prune                # remove dangling (untagged) images
docker image prune -a             # remove every image not used by a container
docker system prune               # all of the above except volumes and unused tagged images

According to the Docker docs, docker system prune removes all stopped containers, all networks not used by at least one container, all dangling images and unused build cache. Volumes are kept unless you add --volumes, which removes anonymous volumes not used by any container. Every prune command asks for confirmation; -f skips the prompt, so use it carefully in scripts.

"Cannot connect to the Docker daemon" and other first-run errors

The docker command is only a client. It sends every request to the Docker engine (the daemon), and most commands fail if the engine isn't running. On Windows with Docker Desktop closed, docker ps prints:

error during connect: this error may indicate that the docker daemon is not running: Get "http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.45/containers/json": open //./pipe/docker_engine: The system cannot find the file specified.

On Linux the same situation starts with Cannot connect to the Docker daemon. Docker's troubleshooting page gives two causes: the daemon isn't running (start Docker Desktop, or sudo systemctl start docker on Linux), or the client is pointed at a remote daemon it can't reach because the DOCKER_HOST environment variable is set. Commands that only read local files, such as docker --help, docker --version and docker compose config, still work without the engine, which makes them a quick way to tell a broken install from a stopped engine.

Two other errors you'll meet early:

• A port or name that's already taken. -p fails if the host port is in use, and --name fails if any container, including a stopped one, already has that name. docker ps -a shows the stopped ones; remove them with docker rm.
• An image that can't be pulled. Check the spelling and tag on the registry page, and run docker login first for private images.

If you're still deciding whether containers are the right tool, Docker vs a virtual machine covers what a container actually isolates.

Frequently asked questions

What is the difference between docker run and docker start?

docker run creates a new container from an image and starts it. docker start restarts a container that already exists but is stopped, keeping its filesystem changes and settings. Running docker run twice gives you two containers; docker start reuses one.

What is the difference between docker stop and docker kill?

docker stop sends SIGTERM so the main process can shut down cleanly, then SIGKILL if it hasn't exited after the grace period (10 seconds for Linux containers by default). docker kill sends SIGKILL immediately, so the process gets no chance to clean up.

Does docker system prune delete my volumes?

Not by default. docker system prune removes stopped containers, unused networks, dangling images and unused build cache. Volumes are only touched if you add --volumes, which removes anonymous volumes not used by any container.

Why does Docker say it cannot connect to the daemon?

The Docker CLI is installed but the engine it talks to is not running, or the DOCKER_HOST environment variable points it at a remote engine it cannot reach. On Windows and macOS start Docker Desktop; on Linux start the service, for example with sudo systemctl start docker.

Sources

• Docker docs: docker CLI reference
• Docker docs: docker container run
• Docker docs: docker container stop
• Docker docs: docker image pull
• Docker docs: Bridge network driver
• Docker docs: docker system prune
• Docker docs: Troubleshooting the Docker daemon