Sidharth R

Docker snippets

Commands for the Docker CLI that each do one job. Copy one straight from this page — the note under each says what it changes before you run it on a server.

Containers

Delete all stopped containers

docker container prune -f

Frees disk on a build box. Each container's writable layer goes with it; volumes are kept.

Delete stopped containers older than a day

docker container prune -f --filter "until=24h"

The same clean-up, but today's crashes stay around for debugging.

List the containers that are stopped

docker ps -a --filter status=exited --filter status=created

What a prune would remove. There is no dry-run flag, so this is the check.

Open a shell inside a running container

docker exec -it <container> sh

sh is in almost every image; use bash where there is one. Distroless images have no shell at all.

Open a root shell in a running container

docker exec -it -u 0 <container> sh

For images that drop to an unprivileged user when you need to read or install something.

Watch CPU and memory per container

docker stats --no-stream

One snapshot instead of a live feed, so it works in scripts and over SSH.

Images

Remove dangling images

docker image prune -f

Only untagged layers left behind by rebuilds, so it is safe to run anywhere.

Remove every image no container uses

docker image prune -af

Also deletes base images you pulled on purpose — the next build downloads them again.

List dangling images

docker images --filter dangling=true

The <none>:<none> rows, before you prune them.

Find what Docker is using disk for

docker system df -v

Splits the total between images, containers, volumes and the build cache. Run it before any prune.

Networking

List every container with its IP address

docker ps -q | xargs docker inspect \
  --format '{{ .Name }} {{ range $net, $conf := .NetworkSettings.Networks }}{{ $net }}={{ $conf.IPAddress }} {{ end }}'

For reaching one container from another by address. With nothing running, xargs still runs inspect and it errors — GNU xargs -r skips it.

Show which host ports a container publishes

docker port <container>

Reads the live mapping rather than what the Dockerfile or compose file asked for.