Commands

https://docs.docker.com/reference/cli/docker/
https://docs.docker.com/reference/cli/docker/container/run/
https://docs.docker.com/reference/cli/docker/container/exec/
https://docs.docker.com/reference/cli/docker/compose/
https://docs.docker.com/engine/manage-resources/pruning/

docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'
docker logs --tail 100 order-api
docker exec -it order-api sh

docker run --rm alpine:3.20 echo "hello"

docker run -d \
  --name order-api \
  --restart unless-stopped \
  -p 3000:3000 \
  -e APP_ENV=dev \
  -e LOG_LEVEL=info \
  order-api:local

restart policy:
    --restart unless-stopped:
        Docker daemon starts the container again after daemon restart or host reboot
        if you manually docker stop it, Docker will not restart it until you start it again

    prerequisite:
        Docker daemon itself must start on boot

sudo systemctl enable docker
sudo systemctl start docker

docker update --restart unless-stopped order-api

docker inspect order-api --format '{{.HostConfig.RestartPolicy.Name}}'

unless-stopped

docker update --restart no order-api

docker run --rm \
  --env-file .env.local \
  -p 3000:3000 \
  order-api:local

env notes:
    .env is runtime config
    do not COPY .env into Docker image
    production secrets should come from platform secret store

docker volume create --label keep=true pgdata

docker run -d \
  --name postgres-dev \
  -e POSTGRES_PASSWORD=postgres \
  -v pgdata:/var/lib/postgresql/data \
  -p 5432:5432 \
  postgres:16

docker run --rm \
  --memory 512m \
  --cpus 1.0 \
  order-api:local

docker exec -it order-api sh
ps aux
env | sort

debug order:
    docker ps
    docker logs --tail 200
    docker inspect
    docker exec only when logs and config are not enough

docker build \
  --pull \
  -t registry.example.com/order-api:1.0.0 \
  .

tag strategy:
    local:
        order-api:local

    release:
        registry.example.com/order-api:1.0.0

    git sha:
        registry.example.com/order-api:git-a1b2c3d

    environment alias:
        registry.example.com/order-api:prod
        only points to currently deployed image, not the immutable rollback reference

docker buildx create --name ci-builder --use
docker buildx inspect --bootstrap

docker buildx build \
  --platform linux/amd64,linux/arm64 \
  -t registry.example.com/order-api:1.0.0 \
  --push \
  .

docker buildx ls
docker buildx rm ci-builder

docker compose up -d

services:
  order-api:
    image: order-api:1.0.0
    restart: unless-stopped
    ports:
      - "3000:3000"

docker compose up -d
docker compose ps

notes:
    restart: unless-stopped works when Docker daemon starts after host reboot
    compose project is not a systemd unit by itself
    Docker restarts containers from the previous compose project as containers

docker compose ps
docker compose logs -f
docker compose logs -f order-api

docker compose restart order-api

docker compose build order-api
docker compose up -d order-api

docker compose down

docker compose down -v

warning:
    docker compose down -v deletes named volumes created by the project
    use it only for local/dev reset

docker network create order-net

docker run -d \
  --name api \
  --network order-net \
  order-api:local

DNS rule:
    containers on the same user-defined bridge network can resolve each other by container name
    host machine cannot resolve that Docker DNS name directly

docker run --rm \
  -v order-data:/data \
  alpine:3.20 \
  sh -c 'echo hello > /data/hello.txt'

docker run --rm \
  -v order-data:/data:ro \
  -v "$PWD":/backup \
  alpine:3.20 \
  tar czf /backup/order-data.tgz -C /data .

docker run --rm \
  -v order-data:/data \
  -v "$PWD":/backup \
  alpine:3.20 \
  tar xzf /backup/order-data.tgz -C /data

docker login registry.example.com

docker tag order-api:local registry.example.com/order-api:1.0.0
docker tag order-api:local registry.example.com/order-api:git-a1b2c3d
docker push registry.example.com/order-api:1.0.0
docker push registry.example.com/order-api:git-a1b2c3d

docker pull registry.example.com/order-api:1.0.0

docker run -d \
  --name order-api \
  -p 3000:3000 \
  registry.example.com/order-api:1.0.0

credential rules:
    use CI secret store for registry username/token
    do not commit Docker config with auth token
    rotate robot account tokens

docker system df
docker container prune --filter "until=168h"
docker image prune -a --filter "until=336h"
docker builder prune --filter "until=168h"

default local cleanup policy:
    run docker system df before cleanup
    prune stopped containers older than 7 days
    prune unused images older than 14 days
    prune build cache older than 7 days
    never prune volumes blindly
    protect data volumes with label keep=true

when to run:
    dev laptop: weekly or when Docker disk usage > 30 GB
    shared Docker host: only during maintenance window
    CI builder: after build or daily, depending on cache value

docker ps --format 'table {{.Names}}\t{{.Ports}}'
lsof -i :3000

fix:
    stop the container using the port
    or change host port, for example -p 3001:3000

docker ps -a
docker logs --tail 200 <container>
docker inspect <container>

common causes:
    command exits by design
    missing environment variable
    application cannot connect to dependency
    file permission problem on mounted volume

docker network inspect <network>
docker inspect <container> --format '{{json .NetworkSettings.Networks}}'

fix:
    put containers in the same user-defined bridge network
    use compose service name for compose services

docker system df
docker images
docker ps -a
docker volume ls
df -h

fix:
    prune stopped containers first
    prune old unused images and build cache
    review volumes before deleting
    check whether logs or /var/lib/docker are filling the host filesystem

docker inspect <container> --format '{{.State.OOMKilled}}'
docker stats <container>
docker logs --tail 200 <container>

fix:
    raise memory limit
    reduce app heap / worker concurrency
    check memory leak with application metrics