Images

docker pull <image>[:<tag>]

docker pull node:20-alpine
docker pull postgres:16

20-alpine: Pulling from library/node
Digest: sha256:a1b2c3...
Status: Downloaded newer image for node:20-alpine

Note If you omit the tag, Docker defaults to :latest, which is a moving target. Always pin a specific version for production work.

docker build [options] <path>

docker build -t myapp:1.0 .
docker build -t myapp:1.0 -f deploy/Dockerfile .

=> [internal] load build definition from Dockerfile
=> CACHED [2/5] RUN apt-get update
=> [3/5] COPY package*.json ./
=> exporting to image
=> naming to docker.io/library/myapp:1.0

Note The dot at the end is the build context - Docker sends that entire directory to the daemon. Use .dockerignore to exclude node_modules and other heavy directories, or your builds will be painfully slow.

docker tag <source_image>[:<tag>] <target_image>[:<tag>]

docker tag myapp:1.0 registry.example.com/myapp:1.0
docker tag myapp:1.0 myapp:latest

Note Tagging does not duplicate image layers - it just creates a new reference pointing to the same image ID. You can have many tags for one image.

docker push <image>[:<tag>]

docker push registry.example.com/myapp:1.0
docker push myuser/api-server:2.4

The push refers to repository [registry.example.com/myapp]
1.0: digest: sha256:abc123... size: 1572

Note You must be logged in first (docker login). The image name must include the registry prefix unless you are pushing to Docker Hub.

docker images [options]
docker image ls [options]

docker images
docker images --format '{{.Repository}}:{{.Tag}} {{.Size}}'

REPOSITORY   TAG         IMAGE ID       CREATED        SIZE
myapp        1.0         a1b2c3d4e5f6   2 hours ago    185MB
node         20-alpine   f6e5d4c3b2a1   3 days ago     130MB

Note Add --filter dangling=true to see images with no tag (often leftovers from rebuilds). These are safe to remove.

docker rmi <image> [<image>...]
docker image rm <image>

docker rmi myapp:1.0
docker rmi $(docker images -q --filter dangling=true)

Untagged: myapp:1.0
Deleted: sha256:a1b2c3...

Note You cannot remove an image that has running or stopped containers using it. Stop and remove those containers first, or use -f to force removal.

docker image prune [options]

docker image prune
docker image prune -a --filter 'until=168h'

Total reclaimed space: 2.3GB

Note Without -a, this only removes dangling images (untagged). With -a, it removes ALL images not used by any container - this can delete base images you pulled but have not yet run. Use with caution.

docker image inspect <image>

docker image inspect node:20-alpine
docker image inspect myapp:1.0 --format '{{.Config.ExposedPorts}}'

[
  {
    "Id": "sha256:a1b2c3...",
    "Config": { "Env": [...], "Cmd": [...] }
  }
]

Note The output is JSON. Use --format with Go templates to extract specific fields like environment variables, labels, or exposed ports.

docker history <image>

docker history myapp:1.0
docker history --no-trunc myapp:1.0

IMAGE          CREATED BY                                SIZE
a1b2c3d4e5f6   CMD ["node" "server.js"]                    0B
<missing>      COPY . /app                                 45MB
<missing>      RUN npm ci --omit=dev                       85MB

Note This shows each layer and the command that created it. Great for diagnosing why an image is larger than expected - look for the biggest SIZE entries.

docker save -o <file.tar> <image>
docker load -i <file.tar>

docker save -o myapp-v1.tar myapp:1.0
# Transfer the file, then on the other machine:
docker load -i myapp-v1.tar

Loaded image: myapp:1.0

Note Useful for air-gapped environments with no registry access. The tarball includes all layers, so it can be large. Consider piping through gzip: docker save myapp:1.0 | gzip > myapp.tar.gz