The Docker command line: images, containers, volumes, and networks

Start using Docker from scratch. Each command's arguments are explained, and every step includes the expected result.

Install Docker#

Linux (distribution package examples)

The commands below use distribution package managers. Package names and sources vary by distribution release and are not guaranteed to provide the latest version from Docker's official repository. Consult the relevant distribution and Docker Engine installation documentation before installing. Membership in the rootful docker group grants effectively root-level control. These installation commands do not apply to NixOS.

# Ubuntu / Debian
sudo apt update
sudo apt install -y docker.io docker-compose-v2
sudo systemctl enable --now docker
sudo usermod -aG docker $USER
# ↑ 把自己加入 docker 组（重新登录后生效），此后不用 sudo

# Fedora
sudo dnf install docker docker-compose
sudo systemctl enable --now docker
sudo usermod -aG docker $USER

# Arch
sudo pacman -S docker docker-compose
sudo systemctl enable --now docker
sudo usermod -aG docker $USER

Verify after installation:

docker version        # 显示客户端和服务端版本
docker info           # 显示系统信息（存储驱动、内核版本等）
docker run hello-world # 跑一个测试容器

NixOS users: See Part 7: NixOS Management in Practice.

Docker Desktop (cross-platform GUI)

Download and install it from docker.com. It includes a GUI, K8s integration, file sharing, and more. Note: Licensing depends on more than employee count; annual revenue and usage context also matter. Check the current Docker Desktop terms. Docker Desktop for Linux uses its own VM/context and does not automatically share an image store with the host Engine.

Image operations#

Search and pull

# 搜索 Docker Hub 上的镜像
docker search nginx
# 输出：NAME（镜像名） DESCRIPTION STARS OFFICIAL
# OFFICIAL = [OK] 表示 Docker Official Images 项目收录，非所有镜像均由 Docker 公司直接维护

# 从 Docker Hub 拉取镜像
docker pull nginx:alpine
#           │     └─ 标签（版本），alpine = 基于 Alpine Linux 的精简版
#           └────── 镜像名，不写仓库默认从 docker.io 拉

# 拉取指定版本
docker pull python:3.12-slim
docker pull node:20-bookworm

# 一次性拉取 + 运行（本地没有时会自动拉）
docker run nginx:alpine

Inspect and manage images

# 列出本机所有镜像
docker images
# 或 docker image ls
# 输出列：REPOSITORY（来源） TAG IMAGE ID CREATED SIZE

# 查看镜像各层信息
docker history nginx:alpine
# 显示镜像历史元数据；不保证逐行还原原始 Dockerfile

# 查看镜像详细 JSON（环境变量、入口命令、暴露端口等）
docker inspect nginx:alpine

# 删除镜像
docker rmi nginx:alpine

# 删除所有未使用镜像（释放空间）
docker image prune -a
# -a 包括未使用的镜像；不加 -a 只删标签 <none> 的悬空镜像

Tag images

# 为本地镜像添加标签
docker tag myapp:latest myapp:1.0
# 两个标签指向同一镜像，不占额外空间

# 为推送到私有仓库做准备
docker tag myapp:latest registry.example.com/myapp:1.0
docker push registry.example.com/myapp:1.0

Container operations#

Run containers

# 最简运行（前台，Ctrl+C 停止）
docker run nginx:alpine

# 后台运行 + 命名 + 端口
docker run -d --name myweb -p 8080:80 nginx:alpine
#         └┘ └───────┘ └───────┘
#    detach   容器名  宿主机:容器
#    (后台)

# 运行后自动删除（一次性任务，退出后删除容器；镜像、命名卷和日志/外部副作用仍可能存在）
docker run --rm alpine echo "hello"

# 交互式（进入容器内 shell）
docker run -it ubuntu bash
#         └┘└┘
#   interactive  分配虚拟终端

# 指定重启策略
docker run -d --restart=always --name web nginx:alpine
# --restart=always   容器退出时总是自动重启
# --restart=on-failure:3  只在异常退出时重启，最多 3 次
# --restart=unless-stopped  除非手动 stop，否则一直重启

Common run arguments: quick reference

Argument	Purpose	Example
`-d`	Run in the background	`docker run -d ...`
`--name`	Name a container	`--name myweb`
`-p`	Publish a port	`-p 8080:80`
`-v`	Mount a volume/directory	`-v myvol:/data` or `-v /host/path:/container/path`
`--rm`	Remove automatically on exit	`--rm`
`-e`	Set an environment variable	`-e DB_URL=postgres://...`
`--env-file`	Load environment variables from a file	`--env-file .env`
`-it`	Interactive mode + terminal	`-it`
`--restart`	Restart policy	`--restart=always`
`--memory`	Memory limit	`--memory=256m`
`--cpus`	CPU limit	`--cpus=1.5`

Check container status

# 正在运行的容器
docker ps
# CONTAINER ID  IMAGE          COMMAND       STATUS        PORTS
# abc123def...  nginx:alpine   "nginx -g..." Up 2 minutes  0.0.0.0:8080->80/tcp

# 所有容器（含已停止）
docker ps -a

# 查看容器日志
docker logs myweb           # 全部日志
docker logs -f myweb        # 实时跟踪（Ctrl+C 退出）
docker logs --tail 50 myweb # 最近 50 行

# 查看容器内进程
docker top myweb

# 查看容器资源使用（实时，类似 top）
docker stats myweb
# 输出 CPU%、内存使用/限制、网络 I/O、磁盘 I/O

# 查看容器详细信息
docker inspect myweb

Manage the container lifecycle

# 停止（发送 SIGTERM，等 10s 后再强杀）
docker stop myweb

# 立即强杀（发送 SIGKILL）
docker kill myweb

# 启动已存在的容器（不是新建）
docker start myweb

# 重启
docker restart myweb

# 暂停/恢复（暂停期间不消耗 CPU，不释放内存）
docker pause myweb
docker unpause myweb

# 进入正在运行的容器
docker exec -it myweb sh
#         └┘└┘ └───┘ └──┘
#   交互 终端 容器名  命令
# 如果容器里没有 bash，试试 sh

# 以不同用户身份进入
docker exec -it -u root myweb sh

# 删除已停止的容器
docker rm myweb

# 强制删除（即使正在运行）
docker rm -f myweb

# 清理所有已停止的容器
docker container prune

Volumes#

Why volumes are needed

Removing a container deletes its writable layer. Independent data, such as named volumes and bind mounts, is retained according to its own lifecycle. Volumes store data on the host, providing persistence and allowing containers to share it.

# 创建命名卷
docker volume create mydata

# 列出卷
docker volume ls

# 带卷启动容器
docker run -d --name db \
  -e POSTGRES_PASSWORD_FILE=/run/secrets/db_password \
  --mount type=bind,src=/path/to/protected-password-file,dst=/run/secrets/db_password,readonly \
  -v mydata:/var/lib/postgresql/data \
  postgres:16-alpine
# └─┬─┘ └──────────┬──────────┘
# 宿主机卷名   容器内路径

# 绑定挂载（直接挂宿主机路径，开发常用）
docker run -v /home/alice/project:/app nginx:alpine
#           └──────┬──────┘ └─┘
#          宿主机绝对路径  容器内

# 卷详情（存在哪、哪个容器在用）
docker volume inspect mydata

# 当前 API 默认清理未被任何容器引用的匿名卷；--all 扩至命名卷，删除前确认数据
docker volume prune

Compare the two mount types

	Named volume (Volume)	Bind mount (Bind Mount)
Management	Managed by Docker	Managed by you
Path	`/var/lib/docker/volumes/...`	Any host path you specify
Initial contents	If the volume is empty, data from the container is copied into it	Obscures the directory inside the container
Use cases	Databases and persistent data	Code synchronization during development

Networks#

# 列出网络
docker network ls
# bridge（默认）、host、none

# 创建自定义网络（同一网络中的容器可用容器名互访）
docker network create mynet

# 在指定网络中运行容器
docker run -d --name web --network mynet nginx:alpine
docker run -d --name db --network mynet \
  -e POSTGRES_PASSWORD_FILE=/run/secrets/db_password \
  --mount type=bind,src=/path/to/protected-password-file,dst=/run/secrets/db_password,readonly \
  postgres:16-alpine

# 在 web 容器中 ping db（通过容器名）
docker exec web ping db   # 镜像需有 ping；此为预期用途，网络策略和工具决定实际结果

# 查看网络和接入的容器
docker network inspect mynet

# 删除网络
docker network rm mynet

Routine maintenance#

# 查看磁盘占用
docker system df
# TYPE        TOTAL  ACTIVE  SIZE     RECLAIMABLE
# Images      5      2       1.2GB    800MB (66%)
# Containers  3      1       50MB     30MB (60%)
# Volumes     2      1       200MB    100MB (50%)

# 删除停止容器、未用网络、未用镜像和构建缓存；--volumes 另清未用匿名卷
docker system prune -a --volumes
# 确认无需停止容器的可写层及匿名卷，已有备份后才执行；命名卷不是此参数全部删除对象

# 查看 Docker 事件流
docker events
# 实时输出：容器创建、启动、停止、删除等事件

Docker commands vs Podman commands#

The two engines have similar common CLI commands, but they are not fully equivalent. For a detailed comparison, see How Docker and Podman Relate.

# 大部分命令可以直接互换
docker run -d --name web -p 8080:80 nginx:alpine
podman run -d --name web -p 8080:80 nginx:alpine

# 主要差异：
# docker 默认 rootful，podman 默认 rootless
# docker compose（原生） vs podman-compose（社区）
# docker swarm（Docker 独有） vs podman pod + play kube

Execution and data boundaries#

Before running any prune, rm, or rmi example, confirm the targets and backups. Volume directories vary with the daemon's data-root, rootless mode, or a Desktop VM; do not assume that they are always under the host's /var/lib/docker. Ports are usually published on all host interfaces by default; for local development, explicitly use -p 127.0.0.1:8080:80. Stop signals and timeouts are configurable, and the semantics of manual stops and daemon restarts must be checked for the selected restart policy. Anyone with administrative access may inspect environment variables; they are not a vault for secrets.

References & further reading

Adapted from technical notes. Examples use generic names.