Docker Documentation

Mac wizards, download Docker Desktop from the website and follow the easy wizard. It comes with all the tools you need!

🧙‍♂️ Magic Note Docker Desktop needs macOS 10.14 or newer to work its magic.

Windows wizards, get Docker Desktop from the website. Make sure your computer has the special Hyper-V and Containers powers turned on!

🧙‍♂️ Magic Note You need Windows 10 64-bit: Pro, Enterprise, or Education to use Docker Desktop.

After installing, open your magic terminal and type these spells to check if Docker is ready:

Copy
docker --version
docker info
Copy

💡 Wizard Tip On Linux, add yourself to the docker group so you don't need to say "sudo" every time:

Copy
sudo usermod -aG docker $USER
Copy

Now that you know about magic pictures and ships, let's learn the secret spells to control them! These are like magic words that tell Docker what to do:

Copy
# See which ships are sailing right now
docker ps

# See all ships (even the ones that stopped sailing)
docker ps -a

# See all the magic pictures you have
docker images

# Download a magic picture from the big library
docker pull nginx:latest

# Launch a ship and let it sail on its own (detached mode)
docker run -d --name my-nginx -p 8080:80 nginx:latest

# Tell a ship to stop sailing
docker stop my-nginx

# Wake up a sleeping ship and make it sail again
docker start my-nginx

# Send a ship back to the magic realm
docker rm my-nginx

# Delete a magic picture you don't need anymore
docker rmi nginx:latest
Copy

Ready for more exciting ship adventures? Let's learn advanced spells to explore and control your magic ships!

Copy
# Launch a ship with a magic portal (interactive shell)
docker run -it --name my-ubuntu ubuntu:latest /bin/bash

# Send a magic message to a sailing ship
docker exec -it my-ubuntu /bin/bash

# Read the ship's adventure diary (logs)
docker logs my-nginx

# Follow the ship's diary as it writes (real-time logs)
docker logs -f my-nginx

# Get all the secret details about a ship
docker inspect my-nginx

# Send treasures between your world and the ship
docker cp ./local-file.txt my-nginx:/path/in/container/
docker cp my-nginx:/path/in/container/remote-file.txt ./
Copy

Time to organize your magic picture collection! Learn spells to find, tag, and clean up your picture library:

Copy
# Search for pictures in the grand library
docker search nginx

# Download a picture with a special version tag
docker pull nginx:1.21-alpine

# Give your picture a fancy name tag
docker tag nginx:latest my-nginx:1.0

# Clean up old pictures you don't use anymore
docker image prune

# Super clean - remove ALL unused pictures
docker image prune -a

# See the story of how a picture was made
docker history nginx:latest

# Get all the secret details about a picture
docker inspect nginx:latest
Copy

Master these powerful spells to create amazing magic recipes! Each spell has a special purpose:

Copy
# FROM - Choose your magic foundation
FROM ubuntu:20.04

# LABEL - Add magical labels to your creation
LABEL maintainer="your-email@example.com"
LABEL version="1.0"
LABEL description="This is a custom Ubuntu image"

# RUN - Cast spells to install and prepare ingredients
RUN apt-get update && apt-get install -y nginx

# CMD - The default magic words to start your creation
CMD ["nginx", "-g", "daemon off;"]

# ENTRYPOINT - Make your creation act like a magical executable
ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["nginx"]

# COPY - Bring treasures from your world into the magic realm
COPY ./index.html /var/www/html/

# ADD - Like COPY but can fetch from distant lands and unpack treasures
ADD https://example.com/file.tar.gz /tmp/
RUN tar -xzf /tmp/file.tar.gz -C /tmp/

# WORKDIR - Set your magical workshop location
WORKDIR /app

# ENV - Set magical environment variables
ENV NODE_ENV=production
ENV APP_VERSION=1.0

# EXPOSE - Open magical portals (ports) for communication
EXPOSE 8080

# VOLUME - Create magical treasure chests for data
VOLUME ["/data"]

# USER - Choose which magical being runs your creation
USER node

# ARG - Define magical variables you can change during creation
ARG VERSION=latest
RUN echo "Building version ${VERSION}"

# HEALTHCHECK - Create a magical health monitor for your creation
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost/ || exit 1

# SHELL - Choose your magical shell for casting spells
SHELL ["/bin/bash", "-c"]
Copy

The Build Realm is like your magical workshop - it's the special area where Docker gathers all your ingredients and tools to create magic pictures. The build process can use any treasures from this realm!

To make your magic faster and your pictures lighter, use a .dockerignore spell to hide secret files and folders from the build realm:

Copy
# .dockerignore spell content (keeps secrets hidden):
node_modules
npm-debug.log
.git
.gitignore
README.md
.env
Dockerfile
.dockerignore
Copy

ARG and ENV are like magical ingredients that change how your recipes work:

Copy
# ARG - Magical variable that disappears after building (build-time only)
ARG VERSION=latest
ARG BUILD_DATE

# ENV - Magical potion that stays with your creation forever (runtime)
ENV APP_VERSION=${VERSION}
ENV NODE_ENV=production

# Using magical arguments when casting the build spell
docker build --build-arg VERSION=1.2.3 --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') -t my-app .
Copy

Master these powerful spells to control your container team! Each spell helps manage your magical team:

Copy
# Wake up your team and let them work quietly
docker-compose up -d

# Wake up your team and rebuild if needed
docker-compose up --build

# Tell your team to take a break
docker-compose stop

# Send your team home and clean up everything
docker-compose down

# Remove sleeping team members
docker-compose rm

# Read your team's adventure diary
docker-compose logs

# Follow one team member's diary in real-time
docker-compose logs -f web

# Send a message to a team member
docker-compose exec web bash

# Make more copies of a team member
docker-compose up -d --scale web=3

# See who's on your team
docker-compose ps

# Update your team's tools
docker-compose pull

# Train your team (rebuild)
docker-compose build

# Show your team's secret plan
docker-compose config
Copy

Unlock the most powerful team magic! These advanced spells give your containers superpowers:

Copy
# Super Team Recipe with Magical Powers!
version: '3.8'

services:
  web:
    build:
      context: .
      dockerfile: Dockerfile.prod
    image: myapp:prod
    ports:
      - "5000:5000"
    environment:
      - FLASK_ENV=production
      - DATABASE_URL=postgresql://user:password@db:5432/myapp
    env_file:
      - .env
    volumes:
      - static_volume:/app/static
    depends_on:
      - db
    restart: unless-stopped
    deploy:
      replicas: 3
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    networks:
      - app-network
      - monitoring

  db:
    image: postgres:13
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./backups:/backups
    restart: unless-stopped
    networks:
      - app-network

volumes:
  postgres_data:
  static_volume:

networks:
  app-network:
    driver: bridge
  monitoring:
    external: true
Copy

Travel between different magical worlds! Use different team recipes for development, testing, and production:

Copy
# Visit different magical worlds with different recipes
docker-compose -f docker-compose.yml -f docker-compose.prod.yml up

# Special powers for the production world
# docker-compose.prod.yml
version: '3.8'
services:
  web:
    environment:
      - FLASK_ENV=production
    deploy:
      replicas: 5
Copy

Copy
# Create a special bridge path for your app
docker network create my-app-network

# Create a path with a custom magical address range
docker network create --subnet=192.168.0.0/16 my-custom-network

# Create a floating overlay path for swarm adventures
docker network create --driver overlay my-overlay-network

# Connect ships to your custom communication path
docker run -d --name web1 --network my-app-network nginx
docker run -d --name web2 --network my-app-network nginx

# Test if ships can talk to each other
docker exec -it web1 ping web2
Copy

Copy
# Open a specific magical doorway
docker run -p 8080:80 nginx

# Open all magical doorways automatically
docker run -P nginx

# Open a doorway to a specific magical address
docker run -p 127.0.0.1:8080:80 nginx

# Open multiple magical doorways
docker run -p 8080:80 -p 8443:443 nginx

# Open a special UDP magical doorway
docker run -p 53:53/udp bind9
Copy

Copy
# Create a named treasure chest
docker volume create my-data-volume

# Give a treasure chest to a ship
docker run -d -v my-data-volume:/container/path nginx

# See all your treasure chests
docker volume ls

# Look inside a treasure chest
docker volume inspect my-data-volume

# Throw away a treasure chest
docker volume rm my-data-volume

# Using Team Magic (Docker Compose)
version: '3.8'
services:
  db:
    image: postgres
    volumes:
      - postgres_data:/var/lib/postgresql/data

volumes:
  postgres_data:
Copy

Copy
# Save treasures from a chest to a magical scroll
docker run --rm -v my-data-volume:/data -v $(pwd):/backup \
  alpine tar czf /backup/my-data-volume-backup.tar.gz -C /data .

# Restore treasures from a magical scroll to a chest
docker run --rm -v my-data-volume:/data -v $(pwd):/backup \
  alpine tar xzf /backup/my-data-volume-backup.tar.gz -C /data

# Backup a wise data keeper's treasures
docker run --rm -v postgres_data:/data -v $(pwd):/backup \
  alpine sh -c 'cd /data && tar czf /backup/postgres-backup.tar.gz .'
Copy

Copy
# Run a private registry container
docker run -d -p 5000:5000 --name registry registry:2

# Push an image to the private registry
docker tag my-app:1.0 localhost:5000/my-app:1.0
docker push localhost:5000/my-app:1.0

# Pull an image from the private registry
docker pull localhost:5000/my-app:1.0

# Set up a secure registry with TLS
# First, generate certificates
mkdir -p certs
openssl req -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key -x509 -days 365 -out certs/domain.crt

# Run the registry with TLS
docker run -d \
  --restart=always \
  --name registry \
  -v "$(pwd)"/certs:/certs \
  -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
  -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
  -p 443:443 \
  registry:2
Copy

Copy
# Log in to Amazon ECR
aws ecr get-login-password --region us-west-2 | docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-west-2.amazonaws.com

# Tag and push to ECR
docker tag my-app:1.0 123456789012.dkr.ecr.us-west-2.amazonaws.com/my-app:1.0
docker push 123456789012.dkr.ecr.us-west-2.amazonaws.com/my-app:1.0

# Log in to Google Container Registry (GCR)
gcloud auth configure-docker

# Tag and push to GCR
docker tag my-app:1.0 gcr.io/my-project/my-app:1.0
docker push gcr.io/my-project/my-app:1.0

# Log in to Azure Container Registry (ACR)
az acr login --name myregistry

# Tag and push to ACR
docker tag my-app:1.0 myregistry.azurecr.io/my-app:1.0
docker push myregistry.azurecr.io/my-app:1.0
Copy

Copy
# Use semantic versioning
docker tag my-app:1.0.0 username/my-app:1.0.0

# Use descriptive tags
docker tag my-app:latest username/my-app:latest
docker tag my-app:stable username/my-app:stable
docker tag my-app:dev username/my-app:dev

# Use environment-specific tags
docker tag my-app:1.0 username/my-app:1.0-prod
docker tag my-app:1.0 username/my-app:1.0-staging
docker tag my-app:1.0 username/my-app:1.0-dev

# Use commit SHA for traceability
docker tag my-app:$(git rev-parse --short HEAD) username/my-app:$(git rev-parse --short HEAD)
Copy

Copy
# 1. Use a minimal base image
FROM alpine:3.14

# 2. Use a non-root user
RUN addgroup -g 1001 -S appgroup && \
    adduser -u 1001 -S appuser -G appgroup
USER appuser

# 3. Use specific version tags
FROM node:14.17.0-alpine3.14

# 4. Remove unnecessary packages
RUN apk add --no-cache nodejs npm && \
    apk del --purge \
    && rm -rf /var/cache/apk/*

# 5. Use multi-stage builds to reduce attack surface
FROM node:14-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

FROM node:14-alpine AS runtime
WORKDIR /app
COPY --from=builder /app/node_modules ./node_modules
COPY . .
USER node
CMD ["node", "server.js"]
Copy

Copy
# Runtime security options
docker run --read-only --tmpfs /tmp nginx
docker run --cap-drop ALL --cap-add CHOWN nginx
docker run -u 1000:1000 nginx
docker run --memory=512m --cpus=0.5 nginx
docker run --security-opt no-new-privileges nginx
Copy

Copy
# Use Docker Scout to scan for vulnerabilities
docker scout cves my-app:1.0

# Use third-party tools like Trivy
# Install Trivy
apt-get install wget apt-transport-https gnupg lsb-release
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
sudo apt-get update
sudo apt-get install trivy

# Scan an image with Trivy
trivy image my-app:1.0
Copy

Copy
# Using Docker secrets in Swarm mode
echo "my-secret-password" | docker secret create db_password -

# Using secrets in a service
docker service create --name db \
  --secret db_password \
  -e POSTGRES_PASSWORD_FILE=/run/secrets/db_password \
  postgres

# Using secrets in Docker Compose
version: '3.8'
services:
  web:
    image: my-app
    secrets:
      - db_password
    environment:
      - DB_PASSWORD_FILE=/run/secrets/db_password

secrets:
  db_password:
    file: ./db_password.txt

# Using environment files for secrets in development
version: '3.8'
services:
  web:
    image: my-app
    env_file:
      - .env
Copy

Copy
# Go application multi-stage build
FROM golang:1.16-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o /app/server .

FROM alpine:latest
RUN apk --no-cache add ca-certificates
WORKDIR /root/
COPY --from=builder /app/server .
EXPOSE 8080
CMD ["./server"]
Copy

Copy
# Java application multi-stage build
FROM maven:3.8-openjdk-11 AS builder
WORKDIR /app
COPY pom.xml .
RUN mvn dependency:go-offline
COPY src ./src
RUN mvn package -DskipTests

FROM openjdk:11-jre-slim
WORKDIR /app
COPY --from=builder /app/target/my-app.jar .
EXPOSE 8080
CMD ["java", "-jar", "my-app.jar"]
Copy

Copy
# Using multiple build stages for different purposes
FROM node:14-alpine AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci

FROM node:14-alpine AS builder
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build

FROM node:14-alpine AS runtime
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY --from=builder /app/dist ./dist
EXPOSE 3000
USER node
CMD ["node", "dist/server.js"]

# Using named stages
FROM node:14-alpine AS base
WORKDIR /app
COPY package*.json ./
RUN npm ci

FROM base AS development
RUN npm ci
COPY . .
CMD ["npm", "run", "dev"]

FROM base AS production
COPY . .
RUN npm run build
CMD ["node", "dist/server.js"]
Copy

Copy
# backend/Dockerfile
FROM python:3.9-slim AS builder

WORKDIR /app
COPY requirements.txt .
RUN pip wheel --no-cache-dir --no-deps --wheel-dir /app/wheels -r requirements.txt

FROM python:3.9-slim AS runtime

WORKDIR /app
COPY --from=builder /app/wheels /wheels
RUN pip install --no-cache /wheels/*

COPY . .

EXPOSE 5000
CMD ["gunicorn", "--bind", "0.0.0.0:5000", "app:app"]
Copy

Copy
# frontend/Dockerfile
FROM node:14-alpine AS builder

WORKDIR /app
COPY package*.json ./
RUN npm ci

COPY . .
RUN npm run build

FROM nginx:alpine AS runtime

COPY --from=builder /app/dist /usr/share/nginx/html
COPY nginx.conf /etc/nginx/nginx.conf

EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]
Copy

Copy
# docker-compose.yml
version: '3.8'

services:
  backend:
    build: ./backend
    environment:
      - DATABASE_URL=postgresql://user:password@db:5432/myapp
      - REDIS_URL=redis://redis:6379/0
    depends_on:
      - db
      - redis
    networks:
      - app-network

  frontend:
    build: ./frontend
    ports:
      - "80:80"
    depends_on:
      - backend
    networks:
      - app-network

  db:
    image: postgres:13
    environment:
      POSTGRES_DB: myapp
      POSTGRES_USER: user
      POSTGRES_PASSWORD: password
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - app-network

  redis:
    image: redis:alpine
    networks:
      - app-network

volumes:
  postgres_data:

networks:
  app-network:
    driver: bridge
Copy

Copy
# docker-compose.prod.yml
version: '3.8'

services:
  backend:
    restart: unless-stopped
    environment:
      - NODE_ENV=production
    deploy:
      replicas: 3
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  frontend:
    restart: unless-stopped
    deploy:
      replicas: 2

  db:
    restart: unless-stopped
    volumes:
      - ./backups:/backups

  redis:
    restart: unless-stopped
Copy

Copy
# Development deployment
docker-compose up -d

# Production deployment
docker-compose -f docker-compose.yml -f docker-compose.prod.yml up -d

# Scale services
docker-compose -f docker-compose.yml -f docker-compose.prod.yml up -d --scale backend=5

# Update services
docker-compose -f docker-compose.yml -f docker-compose.prod.yml pull
docker-compose -f docker-compose.yml -f docker-compose.prod.yml up -d

# View logs
docker-compose -f docker-compose.yml -f docker-compose.prod.yml logs -f backend
Copy