Docker container commands: run, exec, logs, and lifecycle

docker container run

Run a command in a new container.

docker container run busybox
docker container run -P -d nginx
docker container run <IMAGE> <CMD>

When you pass a command after the image name, it replaces the default process defined by CMD:

docker container run -i -t debian /bin/bash

General flags

• --rm — remove the container when it exits.
• -d, --detach — run in the background and print the container ID.
• -i, --interactive — keep STDIN open even if not attached.
• -t, --tty — allocate a pseudo-TTY.
• --name <string> — assign a name.
• -h, --hostname <string> — set the container hostname.
• -v, --volume <list> — bind mount a volume.
• --mount <mount> — attach a filesystem mount.
• --network <string> — connect to a network (default: default).

Ports

-p, --publish <list> — map a container port to the host:

docker container run -p <host_port>:<container_port> <image>
docker container run \
    -p <host_port>:<container_port>/tcp \
    -p <host_port>:<container_port>/udp \
    <image>

-P, --publish-all — publish all exposed ports to random host ports:

docker container run -P <image>

--expose <port> — expose a port without publishing it:

docker container run --expose 1234 <image>

Network

• --network <NETWORK> — connect to a specific network.
• --ip <IP_ADDRESS> — assign a specific IP address.

Bind mounts

The source file or directory should exist on the host.

docker container run -d --mount type=bind,source="$(pwd)"/target,target=/app nginx
docker container run -d -v "$(pwd)"/target:/app nginx

With -v, the target directory does not need to exist beforehand.

Volumes

Volume drivers can store data on remote hosts or cloud providers. When a volume is mounted to a directory that already contains files, those files are copied into the volume.

docker container run -d --name <NAME> \
    --mount type=volume,source=<VOLUME-NAME>,target=<TARGET> <IMAGE>

Read-only:

docker container run -d --name <NAME> \
    --mount type=volume,source=<VOLUME-NAME>,target=<TARGET>,readonly <IMAGE>

Using the -v flag:

docker container run -d --name <NAME> \
    -v <VOLUME-NAME>:<TARGET> <IMAGE>

Environment variables

docker container run -d --name weather-app \
    --env PORT=<PORT> \
    --env NODE_ENV=<NODE_ENV> \
    <image>

Demonstration:

docker run -e var1=val -e var2="val 2" debian env

Use --env-file to pass variables from a file.

Overriding Dockerfile settings

• --entrypoint — replace the Dockerfile ENTRYPOINT.
• -u, --user — run as a specific user (name or UID); replaces USER.
• -w, --workdir — set the working directory; replaces WORKDIR.

Restart policy

docker run --restart on-failure:10 postgres

• no (default) — do not restart.
• on-failure — restart on non-zero exit code; optional :max-retries.
• always — always restart.
• unless-stopped — like always, but not after a manual stop.

Seccomp profiles

docker container run --security-opt seccomp=./default.json

The default profile is available open_in_new here .

Capabilities

docker container run --cap-drop=[CAPABILITY] [IMAGE] [CMD]
docker container run --cap-add=[CAPABILITY] [IMAGE] [CMD]

open_in_new Capabilities list .

CPU and memory limits

docker container run -it --cpus=[VALUE] --memory=[VALUE][SIZE] \
    --memory-swap [VALUE][SIZE] [IMAGE] [CMD]

Example:

docker container run -d --name resource-limits --cpus=".5" --memory=512M \
    --memory-swap=1G rivethead42/weather-app

Verify limits with docker container inspect.

open_in_new Full information .

docker container create

Create a container from an image without starting it. Accepts the same flags as run. Start it with docker container start.

docker container start

Start one or more stopped containers — including containers created with create that have never run.

docker container start <CONTAINER_ID>

docker container stop

Stop running containers. The main process receives SIGTERM, then SIGKILL after a grace period.

docker container stop <CONTAINER_ID>

-t sets the timeout before SIGTERM. SIGTERM allows graceful shutdown; SIGKILL terminates immediately.

docker container restart

Restart one or more containers — equivalent to stop followed by start. Accepts -t for the stop timeout.

docker container kill

Send a signal to the main process (PID 1). Default is SIGKILL.

docker container kill <CONTAINER_ID>
docker container kill -s SIGTRAP <CONTAINER_ID>

docker container pause / unpause

pause freezes all processes via Linux cgroups — no signals are sent. Unlike stop, processes remain in memory. unpause resumes them.

docker container pause <CONTAINER_ID>
docker container unpause <CONTAINER_ID>

docker container rm

Remove one or more containers.

docker container rm <CONTAINER_ID>
docker container rm -f <CONTAINER_ID>   # force-remove running containers

By default, volumes are not removed. Use -v to remove volumes created by the container (if not mounted elsewhere).

Remove all stopped containers:

docker rm $(docker ps -aq)

docker container prune

Remove all stopped containers. Requires confirmation unless -f is passed.

docker container prune
docker container prune -f

docker container ls

List containers.

docker container ls
docker container ls -a              # include stopped
docker container ls -f status=exited
docker container ls -q              # IDs only (useful for piping to rm)

docker container exec

Run a command in a running container.

docker container exec <CONTAINER_ID> <CMD>
docker container exec -it <CONTAINER_ID> /bin/bash
docker container exec -u 0 -it test /bin/bash   # run as root

-i — interactive. -t — attach a TTY.

The command runs in the container’s default directory, or in the WORKDIR if one was set.

Example:

$ ID=$(docker run -d debian sh -c "while true; do sleep 1; done;")
$ docker exec $ID echo "Hello"
Hello
$ docker exec -it $ID /bin/bash

docker container attach

Attach local STDIN/STDOUT/STDERR to a running container’s main process.

docker container attach <CONTAINER_ID>

Ctrl+C terminates the main process and stops the container. Detach without stopping with Ctrl+P, Ctrl+Q (requires -i -t).

docker container logs

Fetch container logs. Logs should be written to STDOUT and STDERR.

docker container logs <CONTAINER_ID>

Nginx example in a Dockerfile:

RUN ln -sf /dev/stdout /var/log/nginx/access.log \
    && ln -sf /dev/stderr /var/log/nginx/error.log

docker container inspect

Display detailed information: start command, IP address, gateway, status, volumes, bind mounts.

docker container inspect <CONTAINER_ID>

Get the IP address:

docker inspect <CONTAINER_ID> | grep IPAddress
docker inspect --format {{.NetworkSettings.IPAddress}} <CONTAINER_ID>

docker container port

List port mappings for a container.

docker container port <container_id>
docker container port <container_id> 6379
docker container port <container_id> 6379/tcp

Useful after docker run -P to discover assigned host ports:

$ ID=$(docker run -P -d redis)
$ docker port $ID
6379/tcp -> 0.0.0.0:32768

docker container top

Show running processes inside a container (runs ps on the host, filtered to the container).

docker container top <CONTAINER_ID>

docker container stats

Display a live stream of resource usage statistics.

docker container stats <CONTAINER_ID>

docker container cp

Copy files between a container and the local filesystem.

docker container cp <CONTAINER>:<PATH> <LOCAL_PATH>
docker container cp <LOCAL_PATH> <CONTAINER>:<PATH>

docker container diff

Show filesystem changes compared to the image the container was started from.

docker container diff <CONTAINER_ID>

Example:

$ ID=$(docker run debian touch /NEW-FILE)
$ docker diff $ID
A /NEW-FILE