Docker

Docker is a set of platform as a service (PaaS) products that use OS-level virtualization to deliver software in packages called containers. The service has both free and premium tiers. The software that hosts the containers is called Docker Engine.

Project Homepage: Home - Docker
Documentation: Docker Documentation | Docker Documentation

---

Installation

One click installation script:

curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh

Run docker as non root user:

sudo groupadd docker
sudo usermod -aG docker $USER

Install Docker Engine : Docker Engine

---

Build Images

---

Docker CLI

Run Containers

COMMAND	DESCRIPTION
docker run IMAGE	Start a new container
docker run --name CONTAINER IMAGE	Start a new container and set a name
docker run -p HOSTPORT:CONTAINERPORT IMAGE	Start a new container with mapped ports
docker run -P IMAGE	Start a new container and map all ports

Container Management:

COMMAND	DESCRIPTION
docker create IMAGE	Create a new container
docker start CONTAINER	Start a container
docker stop CONTAINER	Graceful stop a container
docker kill CONTAINER	Kill (SIGKILL) a container
docker restart CONTAINER	Graceful stop and restart a container
docker pause CONTAINER	Suspend a container
docker unpause CONTAINER	Resume a container
docker rm CONTAINER	Destroy a container

Container Bulk Management

COMMAND	DESCRIPTION
docker stop $(docker ps -q)	To stop all the running containers
docker stop $(docker ps -a -q)	To stop all the stopped and running containers
docker kill $(docker ps -q)	To kill all the running containers
docker kill $(docker ps -a -q)	To kill all the stopped and running containers
docker restart $(docker ps -q)	To restart all running containers
docker restart $(docker ps -a -q)	To restart all the stopped and running containers
docker rm $(docker ps -q)	To destroy all running containers
docker rm $(docker ps -a -q)	To destroy all the stopped and running containers
docker pause $(docker ps -q)	To pause all running containers
docker pause $(docker ps -a -q)	To pause all the stopped and running containers
docker start $(docker ps -q)	To start all running containers
docker start $(docker ps -a -q)	To start all the stopped and running containers
docker rm -vf $(docker ps -a -q)	To delete all containers including its volumes use
docker rmi -f $(docker images -a -q)	To delete all the images
docker system prune	To delete all dangling and unused images, containers, cache and volumes
docker system prune -a	To delete all used and unused images
docker system prune --volumes	To delete all docker volumes

Inspect Containers:

COMMAND	DESCRIPTION
docker ps	List running containers
docker ps -a	List all containers, including stopped
docker logs CONTAINER	Show a container output
docker logs -f CONTAINER	Follow a container output
docker top CONTAINER	List the processes running in a container
docker diff	Show the differences with the image (modified files)
docker inspect	Show information of a container (json formatted)

Run Commands:

COMMAND	DESCRIPTION
docker attach CONTAINER	Attach to a container
docker cp CONTAINER:PATH HOSTPATH	Copy files from the container
docker cp HOSTPATH CONTAINER:PATH	Copy files into the container
docker export CONTAINER	Export the content of the container (tar archive)
docker exec CONTAINER	Run a command inside a container
docker exec -it CONTAINER /bin/bash	Open an interactive shell inside a container (there is no bash in some images, use /bin/sh)
docker wait CONTAINER	Wait until the container terminates and return the exit code

Images:

COMMAND	DESCRIPTION
docker images	List all local images
docker history IMAGE	Show the image history
docker inspect IMAGE	Show information (json formatted)
docker tag IMAGE TAG	Tag an image
docker commit CONTAINER IMAGE	Create an image (from a container)
docker import URL	Create an image (from a tarball)
docker rmi IMAGE	Delete images
docker pull REPO:[TAG]	pull an image/repo from a registry
docker push REPO:[TAG]	push and image/repo to a registry
docker search TEXT	Search an image on the official registry
docker login	Login to a registry
docker logout	Logout from a registry
docker save REPO:[TAG]	Export an image/repo as a tarball
docker load	Load images from a tarball

Volumes:

COMMAND	DESCRIPTION
docker volume ls	List all vol1umes
docker volume create VOLUME	Create a volume
docker volume inspect VOLUME	Show information (json formatted)
docker volume rm VOLUME	Destroy a volume
docker volume ls --filter="dangling=true"	List all dangling volumes (not referenced by any container)
docker volume prune	Delete all volumes (not referenced by any container)

Backup a container

Backup docker data from inside container volumes and package it in a tarball archive.
docker run --rm --volumes-from CONTAINER -v $(pwd):/backup busybox tar cvfz /backup/backup.tar CONTAINERPATH

An automated backup can be done also by this Ansible playbook.
The output is also a (compressed) tar. The playbook can also manage the backup retention.
So older backups will get deleted automatically.

To also create and backup the container configuration itself, you can use docker-replayfor that. If you lose
the entire container, you can recreate it with the export from docker-replay.
A more detailed tutorial on how to use docker-replay can be found here.

Restore container from backup

Restore the volume with a tarball archive.
docker run --rm --volumes-from CONTAINER -v $(pwd):/backup busybox sh -c "cd CONTAINERPATH && tar xvf /backup/backup.tar --strip 1"

Networks

Registries & Authentication

Login / Logout:

COMMAND	DESCRIPTION
docker login	Login to Docker Hub (default registry)
docker login REGISTRY	Login to a specific registry (e.g. ghcr.io)
docker login -u USERNAME REGISTRY	Login with a username (prompts for the password/token)
echo "$TOKEN" | docker login REGISTRY -u USERNAME --password-stdin	Login passing the token via stdin (recommended, keeps it out of shell history)
docker logout	Logout from Docker Hub
docker logout REGISTRY	Logout from a specific registry

Credentials are stored in ~/.docker/config.json (or handed to a credential helper). On a swarm, each node needs its own login, or you pass credentials at deploy time with --with-registry-auth (see below).

GitHub Container Registry (ghcr.io)

GHCR uses a GitHub Personal Access Token (classic) with package scopes:

• read:packages to pull
• write:packages to push
• delete:packages to delete

# Store your PAT in an env var (with the scopes above)
export CR_PAT=YOUR_GITHUB_TOKEN

# Login to GHCR
echo $CR_PAT | docker login ghcr.io -u GITHUB_USERNAME --password-stdin

# Tag, push and pull (owner/name must be lowercase)
docker tag IMAGE ghcr.io/OWNER/IMAGE:TAG
docker push ghcr.io/OWNER/IMAGE:TAG
docker pull ghcr.io/OWNER/IMAGE:TAG

Inside a GitHub Actions workflow you can use the built-in token instead of a PAT:

echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

---

Docker Swarm

Swarm Management:

COMMAND	DESCRIPTION
docker swarm init	Initialize a swarm; the current node becomes the first manager
docker swarm init --advertise-addr IP	Initialize and advertise on a specific address
docker swarm join-token worker	Show the command/token to join as a worker
docker swarm join-token manager	Show the command/token to join as a manager
docker swarm join --token TOKEN HOST:2377	Join an existing swarm (worker or manager)
docker swarm leave	Leave the swarm (worker node)
docker swarm leave --force	Leave the swarm (last manager / force)
docker swarm update ...	Update swarm-wide configuration

Node Management:

COMMAND	DESCRIPTION
docker node ls	List nodes in the swarm
docker node ps [NODE]	List tasks running on a node (defaults to current)
docker node inspect NODE	Show node information (json formatted)
docker node promote NODE	Promote a worker to manager
docker node demote NODE	Demote a manager to worker
docker node update --availability drain NODE	Drain a node (move tasks off, e.g. for maintenance)
docker node update --availability active NODE	Mark a drained node active again
docker node rm NODE	Remove a node from the swarm

Service Management:

COMMAND	DESCRIPTION
docker service create --name NAME IMAGE	Create a service
docker service create --replicas N --name NAME IMAGE	Create a replicated service with N tasks
docker service create -p HOST:CONTAINER --name NAME IMAGE	Create a service with a published port
docker service ls	List services
docker service ps SERVICE	List a service's tasks and their state
docker service inspect SERVICE	Show service information (json formatted)
docker service logs SERVICE	Show service logs
docker service logs -f SERVICE	Follow service logs
docker service scale SERVICE=N	Scale a service to N replicas
docker service rm SERVICE	Remove a service

Update Images & Rolling Updates:

COMMAND	DESCRIPTION
docker service update --image IMAGE:TAG SERVICE	Update a service to a new image (rolling update)
docker service update --image IMAGE:TAG --with-registry-auth SERVICE	Update image and pass registry credentials to nodes (private registries / GHCR)
docker service update --force SERVICE	Force redeploy of tasks (e.g. re-pull a moving tag like :latest)
docker service update --replicas N SERVICE	Change the number of replicas
docker service update --update-parallelism N --update-delay 10s SERVICE	Control how many tasks update at once and the delay between batches
docker service rollback SERVICE	Roll a service back to its previous version

Deploy Stacks (Compose files):

COMMAND	DESCRIPTION
docker stack deploy -c docker-compose.yml STACK	Deploy or update a stack from a compose file
docker stack deploy --with-registry-auth -c docker-compose.yml STACK	Deploy and send registry auth to the nodes (needed for private images / GHCR)
docker stack ls	List deployed stacks
docker stack services STACK	List the services in a stack
docker stack ps STACK	List the tasks in a stack
docker stack rm STACK	Remove a stack

Secrets & Configs:

COMMAND	DESCRIPTION
docker secret create NAME FILE	Create a secret from a file
echo "VALUE" | docker secret create NAME -	Create a secret from stdin
docker secret ls	List secrets
docker secret rm NAME	Remove a secret
docker config create NAME FILE	Create a config from a file
docker config ls	List configs

Typical image-update workflow

Build, push, then roll out the new image to a running service or stack.

For a single service:

# build & push the new image
docker build -t ghcr.io/OWNER/app:1.2.3 .
docker push ghcr.io/OWNER/app:1.2.3

# rolling update on the swarm (--with-registry-auth for private images)
docker service update --image ghcr.io/OWNER/app:1.2.3 --with-registry-auth app

For a stack, bump the image tag in the compose file and re-deploy:

docker stack deploy --with-registry-auth -c docker-compose.yml mystack

Swarm performs a rolling update according to each service's deploy.update_config (parallelism, delay, rollback policy).

Troubleshooting

Networking

docker run --name netshoot --rm -it nicolaka/netshoot /bin/bash