Docker Certified Associate cheat sheet

docker swarm init --advertise-addr turns the node into a manager and prints the worker join command; docker swarm join-token manager|worker reprints a token and --rotate invalidates the old one.

Quorum for N managers is floor(N/2)+1: 3 managers survive 1 failure, 5 survive 2, 2 survive none - an even manager count adds no availability.

docker node update --availability drain evicts running tasks and stops new scheduling; pause stops new tasks but leaves existing ones; active is the default.

docker service create --name web --replicas 3 --publish published=8080,target=80 nginx opens 8080 on every node through the routing mesh, even nodes running no task.

docker stack deploy -c compose.yml mystack names objects mystack_; build: keys are ignored, so images must be pre-built or pullable.

Overlay is the only multi-host driver and needs swarm mode plus 4789/udp and 7946 tcp/udp open; --attachable lets plain containers join, --opt encrypted adds IPsec.

docker service update --image nginx:1.25 web rolls out gradually per --update-parallelism and --update-delay; adding --rollback restores the previous spec.

Secrets from docker secret create are encrypted in the Raft log and mounted read-only at /run/secrets/; configs use the same mechanism but are stored unencrypted.

docker service scale web=5 sets the desired replica count, and swarm automatically reschedules failed tasks to hold that state.

Layer-producing instructions include FROM, RUN, COPY, ADD, ENV, WORKDIR and USER; only the last CMD and the last ENTRYPOINT in a Dockerfile take effect.

ENTRYPOINT sets the executable started at run time; CMD supplies default arguments. Arguments placed after the image name in docker run replace CMD, not ENTRYPOINT.

Multi-stage form: FROM golang AS build … FROM alpine, then COPY --from=build /out/app /app, so compilers and sources never reach the final image.

docker build -t repo/app:1.0 -f Dockerfile.prod --build-arg VERSION=2 --no-cache . ; ARG is build-time only, ENV is persisted into the image config.

When one instruction's inputs change, that layer and every later layer rebuild - instructions are ordered from least to most frequently changing.

docker history lists layer commands and sizes; docker image inspect returns JSON config with Env, Cmd, Entrypoint and exposed ports.

docker tag local:1.0 registry.example.com:5000/team/app:1.0 then docker push; docker login to the registry must happen before the push.

docker save -o app.tar repo/app:1.0 keeps all layers and metadata and docker load -i restores it; docker export/import acts on a container and flattens it to one layer.

docker image prune deletes dangling images, -a deletes every image unused by a container, and docker rmi -f forces removal.

Engine packages from Docker's repository are docker-ce, docker-ce-cli, containerd.io, docker-buildx-plugin and docker-compose-plugin.

Daemon settings live in /etc/docker/daemon.json and are applied with systemctl restart docker; valid keys include data-root, log-driver, log-opts, insecure-registries, registry-mirrors, default-address-pools, live-restore and userns-remap.

Invalid JSON in /etc/docker/daemon.json stops dockerd from starting; the parse error appears in journalctl -u docker or the dockerd output.

docker info reports server version, storage driver, cgroup driver and version, Docker root directory, logging driver, registry mirrors and swarm state.

docker context create/ls/use switches the CLI between daemons; DOCKER_HOST=tcp://host:2376 with DOCKER_TLS_VERIFY=1 is the environment-variable equivalent.

Membership in the docker group is equivalent to root on the host because dockerd runs as root; rootless mode or sudo is the unprivileged alternative.

systemctl edit docker writes a drop-in under /etc/systemd/system/docker.service.d/ for unit-level keys such as Environment or ExecStart.

The default log driver is json-file; log-opts max-size and max-file cap disk usage, and local, journald and syslog are alternative drivers.

Drivers are bridge, host, overlay, macvlan, ipvlan and none; a container gets one network at run time and docker network connect adds more.

The default docker0 bridge resolves names only through --link; a user-defined bridge runs embedded DNS at 127.0.0.11, resolving container names and --network-alias values.

docker network create --driver bridge --subnet 10.10.0.0/16 --gateway 10.10.0.1 net1 defines the IPAM pool, and --ip-range restricts the allocatable slice.

-p 8080:80 maps hostPort:containerPort, -p 127.0.0.1:8080:80 binds only loopback, and -P publishes every EXPOSEd port to a random host port.

--network host shares the host network namespace so -p is ignored; --network none leaves the container with loopback only.

Overlay networks exist only in swarm mode and require 4789/udp (VXLAN) plus 7946 tcp/udp between nodes.

macvlan gives each container its own MAC address, so it appears as a physical host on the LAN and can lease an address from the existing DHCP server.

docker network inspect shows subnet, gateway, IPAM and attached containers; docker network prune removes networks with no endpoints.

--user uid:gid or the USER instruction avoids running as root; --read-only makes the root filesystem immutable and is paired with --tmpfs for writable paths.

--cap-drop ALL followed by targeted --cap-add yields least privilege; Docker's default set is smaller than root but still includes CHOWN, NET_RAW and SETUID.

--security-opt no-new-privileges blocks setuid/setgid escalation; the default seccomp profile blocks dangerous syscalls and can be replaced via --security-opt seccomp=profile.json.

AppArmor is selected with --security-opt apparmor=; SELinux uses --security-opt label=type: and :z or :Z volume labels.

DOCKER_CONTENT_TRUST=1 makes the CLI accept only Notary-signed images on pull and sign on push; docker trust inspect and docker trust sign manage keys.

Swarm secrets are encrypted in the Raft log and mounted at /run/secrets/; configs are stored unencrypted and mounted at / by default.

Secured dockerd uses --tlsverify with --tlscacert, --tlscert and --tlskey on port 2376; port 2375 is plaintext and must not be exposed.

--userns-remap=default maps container root onto an unprivileged host UID range, while rootless mode runs the whole daemon without root.

docker scout cves or docker scan reports known CVEs per layer; smaller base images and pinned tags reduce the surface and drift.

Named volumes are stored under /var/lib/docker/volumes and persist independently of containers; -v myvol:/data creates the volume when it does not exist.

--mount type=volume,source=myvol,target=/data is the explicit form; --mount errors when a bind source path is missing, while -v silently creates it root-owned.

Bind mounts map any host path into the container, do not appear in docker volume ls, and depend on host directory layout, making them less portable.

--tmpfs /tmp or --mount type=tmpfs,target=/tmp provides memory-backed storage that vanishes with the container and is never written to host disk.

overlay2 is the default storage driver on Linux; alternatives include fuse-overlayfs, btrfs, zfs and vfs, which has no copy-on-write and is for testing.

docker volume ls, inspect and prune manage volumes; docker volume rm fails while any container, even a stopped one, references the volume unless -f is used.

Volume plugins extend persistence: docker volume create --driver local --opt type=nfs --opt o=addr=10.0.0.5,rw --opt device=:/export/data nfsvol.

The container writable layer is destroyed by docker rm, while data in volumes and bind mounts survives; docker commit captures the writable layer into a new image.

docker system df reports disk used by images, containers, volumes and build cache, and docker system prune removes stopped containers, unused networks and dangling images.