Cheat sheet

Docker debugging

Containers that won't start, fill the disk or can't reach each other: the commands to find out why. Works with Podman too (podman …).

Exit codes

docker ps -a
All containers, including stopped ones
docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'
Compact overview: name, status, ports
docker inspect -f '{{.State.Status}} exit={{.State.ExitCode}} oom={{.State.OOMKilled}} restarts={{.RestartCount}}' <container>
Why did it stop? Exit code, OOM kill, restart count
docker inspect <container>
Full configuration: mounts, env, network, restart policy
docker restart <container>
Restart a container
docker update --restart unless-stopped <container>
Enable autostart (after reboots and crashes)
docker update --restart no <container>
Disable autostart
docker top <container>
Processes inside the container
docker rm -f <container>
careful Remove a container (data in volumes is kept)

docker logs -f --tail 100 <container>
Follow the last 100 log lines
docker logs --since 30m -t <container>
Last 30 minutes with timestamps
docker logs <container> 2>&1 | grep -i error
Search the log (stderr included)
docker events --since 1h
Starts, stops, OOM kills, health changes of the last hour
docker inspect -f '{{json .State.Health}}' <container>
Health check status and last results
journalctl -u docker --since "1 hour ago"
Docker daemon log

docker exec -it <container> sh
Open a shell (use bash if the image has it)
docker exec -u 0 -it <container> sh
Shell as root, even if the image runs as a user
docker exec <container> env
Environment variables the app sees
docker exec <container> getent hosts <other-service>
Does the container resolve another service by name?
docker cp <container>:<path> .
Copy a file out of the container
docker run --rm -it --network container:<container> nicolaka/netshoot
Debug toolbox (dig, curl, tcpdump…) in the container’s network namespace
docker run --rm -it --entrypoint sh <image>
Start an image with a shell instead of its normal command

docker stats --no-stream
CPU, memory, network and I/O per container
docker system df
Space used by images, containers, volumes, build cache
docker system df -v
The same, per image/container/volume
du -sh /var/lib/docker/containers/*/*-json.log | sort -h | tail
Biggest container log files
docker image prune -a
careful Remove all images not used by a container
docker builder prune
careful Remove the build cache
docker system prune
careful Remove stopped containers, unused networks, dangling images
docker volume ls -f dangling=true
Volumes no container uses. Check before deleting!

docker network ls
Networks
docker network inspect <network>
Subnet, gateway and attached containers
docker port <container>
Published ports
docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}' <container>
IP address(es) of a container
ss -tlpn | grep docker-proxy
Published ports on the host side
firewall-cmd --zone=docker --list-all
AlmaLinux/RHEL: Docker’s firewalld zone (published ports bypass your zone rules!)
nft list ruleset | grep -i docker
NAT/forwarding rules Docker created

docker compose ps
Services of the project in the current directory
docker compose logs -f --tail=100 <service>
Follow the log of one service
docker compose config
Validate and show the final config (env vars resolved)
docker compose up -d
Create/update and start everything
docker compose pull && docker compose up -d
Update to the newest images
docker compose up -d --force-recreate <service>
Recreate one service (e.g. after env changes)
docker compose exec <service> sh
Shell in a service
docker compose down
Stop and remove containers and networks (volumes stay)
docker compose down -v
careful Also deletes named volumes: data loss!

docker images
Local images and sizes
docker inspect -f '{{.Config.Image}}' <container>
Which image a container runs
docker image inspect <image> | grep -A5 -E "Env|Entrypoint|Cmd"
Default env, entrypoint and command of an image
docker history <image>
Layers and their size
docker pull <image>:<tag>
Download/update an image

systemctl status docker
Is the daemon running?
systemctl enable --now docker
Enable: start Docker now and at boot
systemctl disable --now docker docker.socket
Disable: stop Docker and keep it from starting (the socket would restart it)
docker info
Storage driver, cgroup version, root dir, warnings at the end
docker version
Client and server versions
cat /etc/docker/daemon.json
Daemon config. Set log rotation here: {"log-opts": {"max-size": "10m", "max-file": "3"}}
dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo && dnf install docker-ce docker-ce-cli containerd.io docker-compose-plugin
Install Docker CE on AlmaLinux/RHEL 9
podman ps -a
AlmaLinux ships Podman: most docker commands work as podman …

$ curl tools.otw.solutions/docker/logs

Whole sheet in the terminal: curl tools.otw.solutions/docker | less