Docker & Kubernetes cheat sheet

• A container is a normal process. Namespaces limit what it sees, cgroups limit what it can use.
• It shares the host kernel (same uname -r), so it starts fast but is less isolated than a VM.
• An image is read-only layers plus config. A container adds a thin writable layer and a process.
• A tag can move, a digest (image@sha256:...) cannot. Avoid latest.
• free inside a container shows host memory. The cgroup files show the real limit.

docker run -d -p 8088:8080 IMG

Start in the background, publish a port

docker ps -a

List containers, including stopped ones

docker logs NAME

What the process wrote to stdout and stderr

docker exec -it NAME sh

Start a second process in the same namespaces

docker stop NAME

SIGTERM, then SIGKILL after 10 seconds

docker rm NAME / docker rmi IMG

Delete a container / an image

Watch out: ARG, ENV and copied-then-deleted files stay readable in docker history. Use RUN --mount=type=secret for tokens.

FROM node:22-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:22-alpine
WORKDIR /app
COPY --from=build /app/dist ./dist
USER node
CMD ["node", "dist/server.js"]

• Cache order: least-changing first. Rebuild took 1.6 s instead of 7.1 s.
• Layers only add. Delete files in the same RUN that made them.
• Exec form CMD ["node",...] lets SIGTERM reach the app. Shell form wraps it in sh -c.
• .dockerignore: node_modules, .git, .env, logs. Lint with hadolint.

• Use a user-defined network: containers reach each other by name. The default bridge has no name lookup.
• -p 8080:3000 binds all interfaces. Use -p 127.0.0.1:8080:3000 for private services.
• A mounted folder must be writable by the container user (chown it in the image).

docker run -d --name hard \
  --read-only --tmpfs /tmp \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  --memory 128m --pids-limit 100 \
  --user 1000:1000 IMG

Watch out: Never mount /var/run/docker.sock or use --privileged. The socket is root on the host. -e values show in docker inspect.

docker compose up -d --build

Start the stack, rebuild images first

docker compose up -d --wait

Return when services are running or healthy

docker compose logs -f api

Follow one service

docker compose run --rm api CMD

One-off container (migrations)

docker compose down

Remove containers and networks, keep volumes

docker compose down -v

Also delete volumes. Data is gone.

docker compose config

Show the merged file, check syntax

• Service names are DNS names on the project network.
• Short depends_on only orders start. Use a healthcheck plus condition: service_healthy, and still retry in the app.
• compose.override.yaml for development, profiles for optional services. Quote port strings.

• Reconcile loop: make status (current) equal spec (desired), forever.
• A naked Pod is not replaced. Deployment owns a ReplicaSet owns Pods.
• The Deployment selector must match template labels and is immutable.

kubectl apply -f FILE

Create or update from a file

kubectl diff -f FILE

Preview the change

kubectl apply --dry-run=server -f FILE

Validate on the server

kubectl set image deploy/N C=IMG:1.1

Start a rolling update

kubectl rollout status|history|undo

Watch / list / go back (deploy/NAME)

kubectl rollout restart deploy/N

Replace all Pods, rolling

Tip: Defaults are maxSurge: 25% and maxUnavailable: 25%. rollout undo makes a new revision. Check your context before you apply.

• DNS: svc, svc.ns, svc.ns.svc.cluster.local. Only ready pods are in the EndpointSlice.
• Ingress is rules only and needs a controller. pathType (Exact, Prefix) is required. Gateway API is the future.
• NetworkPolicy needs a CNI that enforces it. By default all pods can talk.

• ConfigMap and Secret values are strings. Quote numbers and booleans.
• Env vars are fixed at start. Mounted files update later (not with subPath). Use rollout restart.
• PVC asks, PV is the disk, StorageClass makes it on demand. An unbound PVC leaves the Pod Pending.
• StatefulSet: stable names, DNS and a disk per pod. No replication for you.

Watch out: base64 is not encryption. Secrets sit plain in etcd by default. kubectl apply can copy one into an annotation. Use RBAC, encryption at rest, kubeconform -strict.

1. Readiness probe on every pod, so new pods only get traffic when ready.
2. maxUnavailable: 0 and maxSurge: 1 (or more).
3. Handle SIGTERM and add a preStop sleep. Grace period is 30 s.
4. At least 2 replicas and a PodDisruptionBudget.

• Requests schedule. Limits enforce: CPU throttles, memory OOM-kills (137).
• A stuck rollout shows ProgressDeadlineExceeded. It does not roll back by itself.
• A PDB covers voluntary disruption only. Too strict, it blocks node drains.

kubectl describe pod NAME

Events at the bottom

kubectl logs NAME --previous

Output of the crashed container

kubectl debug -it POD --image=busybox

Ephemeral container, no shell needed

kubectl get events --sort-by=...

Recent events (sort by .lastTimestamp)