Run Options

docker run -p <host_port>:<container_port> <image>
docker run -p <host_ip>:<host_port>:<container_port> <image>

docker run -d -p 8080:3000 myapp:1.0
docker run -d -p 127.0.0.1:5432:5432 postgres:16

Note The format is always host:container. Binding to 127.0.0.1 restricts access to localhost only - critical for databases you do not want exposed on the network. Without an IP, Docker binds to 0.0.0.0 (all interfaces).

docker run -v <host_path>:<container_path>[:<options>] <image>
docker run -v <volume_name>:<container_path> <image>

docker run -v ./src:/app/src myapp:1.0
docker run -v pgdata:/var/lib/postgresql/data postgres:16
docker run -v ./config.json:/app/config.json:ro myapp:1.0

Note Host paths starting with ./ or / create bind mounts. A plain name like pgdata creates or reuses a named volume. Append :ro for read-only. If the host path does not exist, Docker creates it as a directory (not a file), which often causes surprises.

docker run -e <KEY>=<value> <image>
docker run --env-file <file> <image>

docker run -e NODE_ENV=production -e DB_HOST=db myapp:1.0
docker run --env-file .env myapp:1.0

Note Using --env-file keeps secrets out of your shell history and process list. Each line in the file should be KEY=value with no quotes needed around the value.

docker run -d <image>

docker run -d --name web-api -p 3000:3000 myapp:1.0

e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3...

Note Runs the container in the background and prints the container ID. Use docker logs to see its output. Without -d, your terminal is attached and Ctrl+C stops the container.

docker run --name <name> <image>

docker run -d --name redis-cache redis:7-alpine

Note Names must be unique across all containers (running or stopped). If a previous container with the same name exists, remove it first with docker rm, or your run command will fail.

docker run --network <network_name> <image>

docker run -d --name web-api --network app-net myapp:1.0
docker run -d --name db --network app-net postgres:16

Note Containers on the same user-defined network can reach each other by container name (e.g., web-api can connect to db:5432). The default bridge network does NOT provide this DNS - you must create a custom network.

docker run --restart <policy> <image>

docker run -d --restart unless-stopped --name web-api myapp:1.0
docker run -d --restart on-failure:5 --name worker myapp:1.0

Note Policies: no (default), on-failure[:max-retries], always, unless-stopped. 'unless-stopped' will auto-start on daemon boot unless you explicitly stopped the container. 'always' restarts even after manual stops on daemon restart.

docker run --memory <limit> <image>

docker run -d --memory 512m --name web-api myapp:1.0
docker run -d --memory 2g --name db postgres:16

Note Accepts b, k, m, g suffixes. If the container exceeds this limit, the kernel OOM killer will terminate it. Set --memory-swap to the same value to disable swap usage entirely.

docker run --cpus <number> <image>

docker run -d --cpus 1.5 --name worker myapp:1.0
docker run -d --cpus 0.5 --name background-job myapp:1.0

Note The value represents CPU cores (1.5 means one and a half cores). This is a soft limit via CFS scheduling, not a hard reservation. The container can still burst briefly if the host is idle.

docker run --rm <image>

docker run --rm -it python:3.12 python -c 'print(2**100)'
docker run --rm alpine:3.19 cat /etc/os-release

1267650600228229401496703205376

Note Automatically removes the container and its anonymous volumes when it exits. Perfect for one-off commands and throwaway shells. Cannot be combined with --restart.

docker run -it <image> [command]

docker run -it ubuntu:22.04 bash
docker run -it node:20-alpine sh

root@e4f5a6b7c8d9:/#

Note -i keeps stdin open, -t allocates a pseudo-TTY. You almost always want both together. Without -t you get no prompt and no line editing. Without -i you cannot type into the shell.