BR-ANAC-DOV-MOD-1 cheat sheet

A swarm is initialized with docker swarm init; the node that runs it becomes the first manager and issues join tokens for workers and managers.

docker node promote and docker node demote change a node's role; a swarm needs an odd number of managers (3 or 5) to keep Raft quorum during failures.

Services are declared desired state: docker service create --replicas N; the orchestrator reconciles actual tasks toward that desired count.

Global mode runs exactly one task per node (docker service create --mode global); replicated mode runs a fixed count distributed by the scheduler.

Rolling updates use --update-parallelism and --update-delay; --update-failure-action controls pause, continue, or rollback on a failed task.

Stack deploy reads a compose file: docker stack deploy -c compose.yml NAME; stack services are namespaced with the stack name prefix.

Routing mesh publishes a port on every node via --publish published:target; the ingress network load-balances to tasks regardless of which node receives traffic.

Placement is constrained with --constraint (node labels, roles) and spread with --placement-pref spread=node.labels.zone to balance across failure domains.

A Dockerfile builds top-down; each instruction creates a layer, and layers are cached and reused when the instruction text and parent layer are unchanged.

COPY copies from build context only; ADD additionally handles remote URLs and auto-extracts local tar archives, so COPY is the safer default.

Multi-stage builds use FROM ... AS name and COPY --from=name to carry artifacts forward, discarding build tooling from the final image.

RUN executes at build time in a layer; CMD and ENTRYPOINT define runtime defaults, with ENTRYPOINT as the executable and CMD as default arguments.

Use exec-form JSON arrays for ENTRYPOINT/CMD so the process receives signals directly instead of running under a shell.

ARG values are build-time only and are not persisted in the image; ENV values persist into the running container environment.

The build context is sent to the daemon; .dockerignore excludes files to shrink context size and avoid leaking secrets into layers.

docker build --no-cache forces full rebuild; combining RUN steps and ordering least-changing instructions first maximizes cache hits.

docker ps lists running containers; -a includes stopped ones; -q returns IDs only for scripting.

docker logs shows stdout/stderr; --follow streams live and --tail N limits history, since logs are captured at the container level.

docker inspect returns JSON metadata (config, mounts, network settings, state); --format with Go templates extracts single fields.

docker stats reports live CPU, memory, network, and block I/O per container; --no-stream prints one snapshot and exits.

docker exec -it NAME sh runs a process inside a running container; docker run starts a new container from an image.

docker system prune removes stopped containers, unused networks, and dangling images; --volumes also removes unused volumes (destructive).

docker events streams daemon events such as create, start, die, and destroy, useful for auditing lifecycle changes.

docker update changes limits on a running container (for example --memory, --cpus) without recreating it, when the runtime supports it.

An image reference is registry[:port]/namespace/repository:tag; omitting the registry defaults to Docker Hub, and omitting the tag defaults to latest.

docker login stores credentials in the configured credential store; docker logout removes them for that registry.

docker tag creates an additional reference to the same image ID; docker push uploads only layers the registry does not already have.

docker pull fetches manifest then missing layers; digest references (name@sha256:...) pin immutable content regardless of tag movement.

A private registry can be run with the registry:2 image; TLS and auth are configured via environment variables or a config file.

docker manifest inspect reads a manifest list without pulling; multi-arch images resolve to the platform-matching manifest at pull time.

Registries store content-addressable blobs plus manifests; deleting a tag does not delete blobs until garbage collection runs.

Docker Engine runs dockerd; the client CLI talks to it over a Unix socket (/var/run/docker.sock) or a TCP endpoint.

The daemon config file is /etc/docker/daemon.json; changes require a daemon reload/restart, and invalid JSON prevents startup.

Adding a user to the docker group grants root-equivalent access, because socket access permits privileged container creation.

The systemd unit is docker.service; systemctl enable docker makes it start at boot, and journalctl -u docker reads daemon logs.

Docker Desktop bundles the engine, CLI, and Compose in a VM on macOS/Windows; Linux uses the native engine package.

The daemon can listen on TCP with TLS via --host and --tlsverify plus ca.pem, cert.pem, and key.pem for remote clients.

Storage drivers (overlay2 on most Linux hosts) are configured in daemon.json; the driver choice affects layer performance and features.

Default bridge networks do not provide automatic DNS resolution by name; user-defined bridge networks do.

docker network create --driver bridge NAME creates a user-defined network; containers attach with --network and resolve each other by name or alias.

Published ports (-p host:container) use NAT; -P publishes all exposed ports to random host ports.

Host network mode shares the host's network namespace, so no port mapping is needed but port conflicts are possible.

Overlay networks span swarm nodes and require encrypted control-plane traffic; the ingress network carries routing-mesh traffic.

The none network gives a container only a loopback interface, isolating it from all external networking.

Embedded DNS listens at 127.0.0.11 inside user-defined networks; --dns and --dns-search override upstream resolvers.

Containers share the host kernel; isolation comes from namespaces plus cgroups, not from hardware virtualization.

Run as non-root with USER in the Dockerfile and --user at runtime; root inside a container maps to root on the host unless user namespaces are enabled.

Capabilities can be dropped (--cap-drop ALL) and selectively added (--cap-add NET_BIND_SERVICE) to reduce privilege.

--read-only mounts the root filesystem read-only; combine with tmpfs or volume mounts for paths that must be writable.

Secrets should not be baked into image layers; use BuildKit secret mounts or runtime secret injection instead of ENV or ARG.

Content trust and digest pinning verify image provenance; scanning tools detect known CVEs in image packages.

The no-new-privileges flag blocks setuid escalation inside the container; seccomp and AppArmor/SELinux profiles restrict syscalls.

Volumes are managed by Docker under /var/lib/docker/volumes and are the preferred mechanism for persistent data.

Bind mounts map an arbitrary host path into the container; they depend on host layout and are not managed by Docker.

tmpfs mounts keep data in memory only and vanish when the container stops; useful for sensitive scratch data.

Named volumes persist after container removal; anonymous volumes may be pruned, and -v name:/path reuses an existing named volume.

The --mount flag is more explicit than -v; it distinguishes type=volume, type=bind, and type=tmpfs with key-value options.

Volume drivers (for example NFS or cloud block storage) let volumes outlive a single host and be shared across swarm nodes.

docker volume ls, inspect, and rm manage volumes; docker volume prune removes volumes not referenced by any container.