docker.cli.txt

                                  ┏━━━━━━━━━━━━━━━━━━━┓
                                  ┃   DOCKER ENGINE   ┃
                                  ┗━━━━━━━━━━━━━━━━━━━┛

SUMMARY ==>                       #Container (i.e. OS-level virtualization) technology.
                                  #Abstraction of LXC:
                                  #  - isolate filesystem, processes, network, users|groups (each can be relaxed)
                                  #  - Linux only (runs on other OS with hardware virtualization)
                                  #  - uses OCI
                                  #Client-server architecture, with a REST API
                                  #Use images:
                                  #  - filesystem snapshots, with metadata (labels) and environment variables
                                  #  - with a layer system:
                                  #     - use caching
                                  #     - can see history|diff
                                  #     - use "storage driver", e.g. union filesystems
                                  #  - created through: build|Dockerfile (declarative), commit (imperative), import|load (serialization)
                                  #  - can have several names ("tags")
                                  #  - application-centric: meant to execute a specific command with|without arguments (microservice)
                                  #  - use a registry (e.g. Docker Hub)
                                  #  - should use microcontainers, especially: official images with alpine tag, iron/IMAGE, alpine, busybox, scratch
                                  #Containers are instances:
                                  #  - can be started|stopped, paused|unpaused
                                  #  - can configure automatic restart policy, healthchecks
                                  #Data:
                                  #  - can copy files in|out
                                  #  - data volumes: break filesystem isolation to provide speed or distributed data
                                  #Networks:
                                  #  - isolate with NAT, while still providing internode networking: single-host (bridge, macvlan) or
                                  #    multi-host (overlay)
                                  #  - can configure IP routing, MAC, IPAM, ports, DNS|hostnames, TLS
                                  #Security:
                                  #  - user|group can be isolated, but must configure it
                                  #  - server runs as root
                                  #  - can configure kernel capabilities, SELinux, Apparmor, Seccomp
                                  #Performance:
                                  #  - near native, but must configure it
                                  #  - can impose limits: ulimit, CPU, memory, I/O, processes, IPC
                                  #Inspecting:
                                  #  - many debugging commands
                                  #  - can configure standard streams and signals redirection
                                  #  - logging:
                                  #     - container's stdout|stderr: can use different drivers (e.g. syslog, AWS, etc.)
                                  #     - server events
                                  #  - container processes monitoring

PROJECTS ==>                      #Most of this documentation is "Docker engine"
                                  #Also documented:
                                  #  - static analysis of images

DOCKER COMPOSE ==>                #Docker compose is partly documented here, partly in its own file

DOCKER CS ENGINE ==>              #Like Docker Engine, but with commercial support
                                  #E.g. backport fixes to previous versions, and regular support

DOCKER DATACENTER ==>             #CS engine + Universal Control Plane + Docker trusted registry

                                  ┌─────────────┐
                                  │   VERSION   │
                                  └─────────────┘

VERSION ==>                       #1.12.3

docker version                    #Prints current client|server version
-f GOTMP
--format GOTMP                    #

SYSINFO."Server Version"
NODEINFO.Description.Engine.
 EngineVersion                    #

IMAGEINFO.DockerVersion           #The image was created with

                                  ┌──────────────────┐
                                  │   INSTALLATION   │
                                  └──────────────────┘

OS ==>                            #Built on top of LXC, so only run on Linux
                                  #However, on Mac or Windows, installation tools create virtual machine

DOCKER MACHINE ==>                #Two purposes:
                                  #  - old way to install docker engine on Windows or Mac, before "Docker for Windows/Mac". Not really needed.
                                  #  - uses VirtualBox
                                  #  - SSH + docker engine installer/upgrader/manager for remote hosts. Also install Docker Swarm (not swarm mode)
                                  #  - supports most cloud providers

DOCKER TOOLBOX ==>                #docker engine + compose + machine + virtualBox + kitematic
                                  #Meant to install docker on old Windows/Mac. Use "docker for Windows/Mac" instead

DOCKER FOR WINDOWS/MAC ==>        #Install docker engine, compose and (Windows only) machine, on a Linux virtual machine
                                  #  - using Hyper-V (Windows), Hyperkit (Mac)
                                  #  - for newer versions only: Windows 10, MacOS 10.10.3

                                  ┌──────────────┐
                                  │   NOTATION   │
                                  └──────────────┘

ID                                #Can always be shortened

GOTMP                             #Go template, taking an OBJ as input.
                                  #Has extra available FUNC:
                                  #  - join ARR
                                  #  - json VAL
                                  #  - lower|upper|title STR
                                  #  - split STR "CHAR"

DUR                               #Go duration strings, i.e. [NUMh][NUMm][NUMs][NUMms][NUMus][NUMns]

                                  ┌──────────────────────────┐
                                  │   ISOLATION/NAMESPACES   │
                                  └──────────────────────────┘

docker build|create ...
ISOLATION ==>                     #Provide isolation:
                                  #  - filesystem, except for data volumes or related (--device, --tmpfs)
                                  #  - processes: PID, process list
                                  #  - IPC
                                  #  - network: interfaces, hostnames
                                  #  - users, groups

--isolation STR                   #Underlying isolation technology among:
HOSTCONF.Isolation                #  - process: OCI
                                  #  - hyperv: Hyper-V (virtual machines)
                                  #  - default or "" (def): "process" on Linux, "hyperv" on Windows

                                  ┌────────┐
                                  │   OS   │
                                  └────────┘

SYSINFO."Kernel Version"          #
SYSINFO."Operating System"        #
SYSINFO.OSType
IMAGEINFO.Os
NODEINFO.Description.Platform.OS  #E.g. linux
SYSINFO.Architecture
IMAGEINFO.Architecture
NODEINFO.Description.Platform.
 Architecture                     #E.g. x86_64


docker create ...
--sysctl VAR=VAL
HOSTCONF.Sysctls.VAR              #Linux kernel options (using sysctl)

                                  ┌─────────┐
                                  │   OCI   │
                                  └─────────┘

OCI ==>                           #Docker is built on top of "Open containers", using containerd
dockerd ...
--containerd FILE                 #Path to containerd socket
--add-runtime NAME=PATH
DOCKERCONF.runtimes.NAME.path     #Adds OCI-compatible runtime (like runC)
--default-runtime NAME
DOCKERCONF.default-runtime
SYSINFO."Default runtime"         #Picks OCI-compatible runtime (like runC)
--exec-opt VAR=VAL                #Options passed to OCI runtime, e.g.
DOCKERCF.runtimes.NAME.runtimeArgs#  - native.cgroupdriver systemd or cgroupfs (def)
                                  #     - can be seen with SYSINFO."Cgroup driver"

docker create ...
--runtime NAME
SYSINFO.Runtimes
HOSTCONF.Runtime                  #

                                  ┌────────────────┐
                                  │   MAIN FILES   │
                                  └────────────────┘

DOCKERDIR                         #Runtime directory for high-level dockerd with notably:
dockerd ...                       #  - containers/CONTAINER_ID/:
-g DOCKERDIR                      #     - log files
--graph DOCKERDIR                 #     - config, including routing
SYSINFO."Docker Root Dir"         #  - images/
                                  #  - network/
                                  #  - volumes/: data volumes
                                  #  - swarm/: swarm state
                                  #  - tmp/: can choose different dir with ENVVAR DOCKER_TMPDIR
                                  #Def: /var/lib/docker/

RUNDOCKERDIR
--exec-root DIR                   #Runtime directory for low-level dockerd with notably: containerd, networking

DOCKERPIDFILE                     #PID of dockerd. Def: /var/run/docker.pid
dockerd ...
-p PIDFILE
--pidfile PIDFILE                 #


DOCKERHOME                        #~/.docker/
docker ...
--config=DOCKERHOME [COMMAND]     #Overrides
ENVVAR DOCKER_CONFIG              #If COMMAND, only overrides for docker COMMAND

DOCKERCONF                        #Either:
                                  #  - docker --config=FILE
                                  #  - DOCKERHOME/config.json

                                  ┌────────────┐
                                  │   SERVER   │
                                  └────────────┘

CLIENT-SERVICE ARCHITECTURE ==>   #Client is connected to server (daemon)
                                  #Server can bind to (according to -H):
                                  #  - unix:///PATH: Unix socket (def: unix:///var/run/docker.sock)
                                  #  - tcp://HOST[:PORT][/PATH]: TCP:
                                  #     - def PORT: 2375 if no TLS, 2376 if TLS
                                  #     - PATH will be prepended to all requests
                                  #  - fd://[NUM]: systemd socket
dockerd|docker|docker-compose ...
-H ...
--host ...                        #Address server listens to, or client connects to
ENVVAR DOCKER_HOST                #Can be used multiple times


DOCKERCONF.HttpHeaders.VAR        #HTTP header named VAR, value VAL, to add, i.e. always sent by client to server


SERVER                            #Theoritically a server has a name (def: "docker") and a SERVER_ID (def: random)
                                  #I do not know how to set it though
SYSINFO.ID                        #


dockerd                           #Starts server
                                  #Can change binary path with ENVVAR DOCKERD
                                  #There is support for:
                                  #  - SysVInit: e.g. start (once) with: sudo service docker start
                                  #  - systemd: e.g. start (at each boot) with: sudo systemctl enable docker
                                  #  - upstart
DOCKER_OPTS                       #Extra flags passed to dockerd
--config-file DOCKERCONF          #JSON config file (def: /etc/docker/daemon.json) to pass extra flags to dockerd
                                  #Cannot be in conflict with options passed on the CLI
                                  #Flags that can appear several times use plural name, e.g. --label STR -> "labels" STR_ARR
                                  #Can be reloaded by sending SIGHUP to dockerd:
                                  #  - only for --debug, --labels, --live-restore, --max-concurrent-*


/etc/default/docker               #File read when using SysVInit or upstart, usually setting ENVVAR


MULTIPLE SERVERS ==>              #To run multiple servers on a single host, must be separated from each other using these
                                  #options (documented elsewhere in this doc):
                                  #  - --exec-root, --graph, --pidfile: for filesystem
                                  #  - --config-file: for config
                                  #  - --bridge, --host, --iptables, --tls*: for networks


dockerd ...
--api-cors-header STR             #Sets Access-Control-Allow-Origin [S] (def: no CORS enabled), so that client can be on different host than server


COMPOSE_HTTP_TIMEOUT             !#Def: 60 (in secs)

                                  ┌──────────────┐
                                  │   REST API   │
                                  └──────────────┘

ENVVAR DOCKER_API_VERSION
ENVVAR COMPOSE_API_VERSION        #To specify which version to use (def: latest)

COMPATIBILITY ==>                 #400 if client is newer than server

USES ==>                          #Very similar as CLI commands
                                  #On all entities: container, image, volume, network, plugin, node, swarm, node, service, task
                                  #GET requests have query variables to filter
                                  #Very often, format will be similar to "inspect" CLI commands, e.g. docker volume inspect's output
                                  #See online for more info

ERRORS ==>                        #OBJ: message STR

                                  ┌─────────┐
                                  │   CLI   │
                                  └─────────┘

AUTOCOMPLETION ==>                #Available for Bash, Fish, ZSH, PowerShell
                                  #Under GitHub source at /contrib/completion/

WHARFEE ==>                      ##Shell application that adds to Docker CLI:
                                 ##  - autocompletion
                                 ##  - syntax highlighting
                                 ##  - removes need to type "docker"
                                 ##Version 0.10

                                  ┌──────────────┐
                                  │   BUILDING   │
                                  └──────────────┘

IMAGE/CONTAINERS ==>              #Are basically a filesystem snapshot|archive (i.e. tree of files), with metadata (e.g. COMMANDs)
                                  #Image|containers are basically the same except:
                                  #  - order: container is topmost layer, images all others
                                  #  - write operations:
                                  #     - when writing to a file, use topmost layer where this file exists:
                                  #        - container is read-write, i.e. normal operation
                                  #        - images are read-only, copy-on-write: copy the file (applying modification to it) to topmost layer
                                  #          (i.e. container)
                                  #  - git commit transform container into image

IMAGE                             #Pulled from registry unless available locally
                                  #Is either:
                                  #  - IMAGE_ID:
                                  #     - SHA256 content hash
                                  #  - [HOST/][REPO_USER/]IMAGE_NAME[:TAG][@sha256:HASH]:
                                  #     - def HOST: registry-1.docker.io
                                  #     - REPO_USER (if push|pull, def: docker): see Registry
                                  #     - IMAGE_NAME: [[:alnum:]._-]
                                  #     - def TAG: latest
                                  #        - should always specify precise TAG to avoid unpredictability
                                  #        - should use same tags across environments (dev, prod, etc.) and avoid environment-specific tags.
                                  #          Use ENVVAR instead
                                  #     - HASH: content hash
DL3006|3007                      ##Do not use IMAGE or IMAGE:latest, but use IMAGE:TAG, because "latest" adds unpredictability


docker commit CONTAINER [IMAGE]   #Creates a new (or copies to an) IMAGE, from an existing CONTAINER
-c COMMAND                        #Execute Dockerfile command
--change COMMAND                  #Can only be CMD|ENTRYPOINT|ENV|EXPOSE|LABEL|ONBUILD|USER|VOLUME|WORKDIR
-p false                          #Do not temporaly pause the CONTAINER (if it's running).
--pause false                     #Pausing is done to avoid data corruption while docker commit is ongoing


docker build DIR|URI|-            #Creates an IMAGE from a DIR with a Dockerfile inside.
docker-compose build [IMAG_NAM...]#URI can be:
                                  #  - Dockerfile
                                  #  - DIR
                                  #  - .tar[.xz|bz2|gz] archive
                                  #  - Git repo URI[#TAG|BRANCH|HASH_ID][:SUBPATH]: using git clone --depth 1 --recursive
                                  #"-" is stdin:
                                  #  - must be a Dockerfile
                                  #  - can be compressed with .tar[.xz|bz2|gz]
                                  #Non-0 exit code if fails
CPSCONF.build
CPSCONF.build.context             #DIR|URI. First syntax is short version
-f DOCKERFILE
--file DOCKERFILE
CPSCONF.build.dockerfile          #
-q
--quiet                           #


docker import FILE|URI|- [IMAGE]  #Create an IMAGE from a set of files, i.e. directory, archived in a .tar file.
                                  #Prints IMAGE_ID
                                  #FILE|URI|-: like docker build
                                  #If IMAGE, will call docker tag NEW_IMAGE IMAGE
                                  #See also docker export
-c COMMAND
--change COMMAND                  #Like docker commit


docker load                       #Create an IMAGE from a serialized IMAGE.tar (created by docker save)
                                  #Input is stdin, or -i|--input FILE.tar
-q
--quiet                           #


docker rmi IMAGE                  #Deletes an IMAGE
-f
--force                           #Deletes even if there are related containers
--no-prune                        #Do not delete parents without tags

                                  ┌────────────────┐
                                  │   DOCKERFILE   │
                                  └────────────────┘

DOCKERFILE                        #Main configuration file, with commands below
                                  #Def: BUILD_DIR/Dockerfile, or docker build -f DOCKERFILE
                                  #Can concatenate several Dockerfiles into one


# COMMENT                         #

# escape=CHAR                     #Changes escape character (def: \)
                                  #Can use escaped newlines, and should use them to sort long list alphabetically (e.g.  packages)
                                  #Must be at top of file, before any instruction, comment or blank line


hadolint [DOCKERFILE]            ##Dockerfile linter.
                                 ##Prints to stdout and use exit code 1 if any error
                                 ##Def DOCKERFILE: stdin
                                 ##Also available as:
                                 ##  - Docker image
                                 ##  - web app
                                 ##There is also a parser/AST in Haskell
                                 ##List of errors are documented in this doc as DL* (RULECODE)
                                 ##Other rules:
                                 ##  - SC*: various Shell errors, linted with ShellCheck
                                 ##Version 1.2.1
--ignore RULECODE                ##Most rules make sense, so should not have to ignore any



dockerfile_lint                  ##Dockerfile linter. Prefer hadolint

                                  ┌──────────────────┐
                                  │   IMAGE LAYERS   │
                                  └──────────────────┘

BUILD LAYERS ==>                  #Works in layers:
                                  #  - each layer only contains modification from parent
                                  #     - container is last layer, read-write
                                  #     - images are others, read-only, shared by reference
                                  #  - uses "storage drivers" (see below)
                                  #Each Dockerfile instruction (docker build) or commit (docker commit) creates a new layer:
                                  #  - intermediate IMAGE are removed at the end
                                  #  - each layer creates a new shell
                                  #     - e.g. $PWD will be reset, unless set with WORKDIR
                                  #     - should limit number of layers, i.e. combine instructions as much as possible
                                  #  - max 127 layers
                                  #  - prefer Dockerfile over commit, as it is easier to repeat and is more declarative
docker build ...
docker-compose build ...
--rm=false                        #Do not remove intermediate IMAGE
--force-rm                       |#Force removing intermediate IMAGE


BUILD CACHE ==>                   #Each layer + next instruction is cached:
                                  #  - by def reused if matched
                                  #  - specified in output log "Using cache"
                                  #Invalidates cache:
                                  #  - ADD|COPY of new|newer files
                                  #     - i.e. should be as late as possible, in order to invalidate fewer cache
                                  #  - ARG with different value
                                  #Does not invalidate cache:
                                  #  - COMMANDs, even if takes input from some global/changing state
                                  #     - e.g. apt-get install without version pinning
                                  #  - this can create problem
docker build ...
docker-compose build ...
--no-cache                       |#


docker history IMAGE              #Show all IMAGE layers:
                                  #  - IMAGE_ID (might be <missing> if removed, e.g. intermediary)
                                  #  - ctime
                                  #  - change: Dockerfile instruction, docker commit change, etc.
                                  #  - size
                                  #  - comment: see --message COMMIT_MESSAGE
--no-trunc                        #Do not truncate IMAGE_ID nor change
-q
--quiet                           #Only print IMAGE_ID
-H false
--human false                     #Do not show human-friendly size

IMAGEINFO.Container               #CONTAINER_ID of the container this IMAGE was created from, i.e. container created from parent image
IMAGEINFO.ContainerConfig         #CONTAINERINFO.Config of IMAGEINFO.Container
IMAGEINFO.RootFS                  #List of layers


docker diff CONTAINER             #Prints difference between a CONTAINER and its IMAGE, i.e. what would be committed by docker commit
                                  #Prints as A|C|D PATH (add|changed|deleted)

                                  ┌──────────────────┐
                                  │   IMAGES DEBUG   │
                                  └──────────────────┘

docker images [IMAGE]             #Prints images with information (one line per image+tag combination):
                                  #  - IMAGE (repository)
                                  #  - tag
                                  #  - sha256 checksum (if --digests)
                                  #  - image ID (truncated unless --no-trunc)
                                  #  - ctime
                                  #  - size
-a
--all                             #Prints all (do not hide intermediate images)
-q
--quiet                           #Only show image ID
--filter VAR=VAL                  #VAR:
                                  #  - dangling BOOL: true means no tag, and not intermediary image
                                  #  - label VAR[=VAL]
                                  #  - before|since IMAGE: using ctime
--format GOTMP                    #Input is OBJ:
                                  #  - Repository IMAGE
                                  #  - Tag
                                  #  - Digest
                                  #  - ID IMAGE_ID
                                  #  - CreatedSince|At
                                  #  - Size
                                  #Def is DOCKERCONF.imagesFormat "GOTMP"

SYSINFO.Images                    #NUM
IMAGEINFO.Id                      #IMAGE_ID
IMAGEINFO.Config.Image
IMAGEINFO.Parent                  #IMAGE_ID or "" (if none)
IMAGEINFO.RepoDigests             #sha256 checksum
IMAGEINFO.Created                 #"DATE"
IMAGEINFO.[Virtual]Size           #NUM


docker inspect IMAGE...           #Prints IMAGEINFO, i.e. debug information, as JSON
-f GOTMP
--format GOTMP                    #
--type image|container|task       #If there is ambiguity

                                  ┌──────────┐
                                  │   TAGS   │
                                  └──────────┘

docker tag IMAGE IMAGE2           #Make IMAGE2 a link to IMAGE, i.e.:
                                  #  - IMAGE_ID IMAGE_NAME: gives a name
                                  #  - IMAGE IMAGE:TAG: create tag
                                  #  - IMAGE REPO_USER/IMAGE_NAME: associate with a repository
docker build ...
-t IMAGE2
--tag IMAGE2
IMAGEINFO.RepoTags                #Performs docker tag IMAGE_ID IMAGE2 after creating IMAGE
CPSCONF.image                     #Same, but also do docker pull (unless CPSCONF.build exist)

                                  ┌────────────────┐
                                  │   BASE IMAGE   │
                                  └────────────────┘

MICROCONTAINER ==>                #Container image optimized for small size
                                  #Goal:
                                  #  - fastest to download, i.e. to deploy
                                  #  - more secure: less surface attack

RECOMMENDATION ==                 #Use:
                                  #  - scratch: with statically linked binaries
                                  #  - busybox: when only basic shell and Unix commands needed
                                  #  - official images:
                                  #     - for everything else
                                  #     - with alpine tag
                                  #     - if no alpine tag, use iron/IMAGE
                                  #  - alpine: as a base, if no official image nor iron/IMAGE

RUNTIME ==>                       #A small Linux core is always created runtime:
                                  #  - (using tmpfs) /dev/console, /dev/pts, /dev/shm, /proc, /sys
                                  #  - minimal /etc: hosts, hostname, resolve.conf, mtab
                                  #Created runtime, so:
                                  #  - does not take image space
                                  #  - cannot be manipulated at buildtime

scratch                           #Docker IMAGE with nothing in it (i.e. 0 bytes)
                                  #  - no binary, i.e.:
                                  #     - no shell, no apt-get, etc.
                                  #     - need to use ADD|COPY
                                  #  - is actually a no-op (does not create a layer)
                                  #Binaries must be statically linked, or provide dynamic libraries (incuding ld and e.g. libc) to run

BUSYBOX ==>                       #Single 1-2MB binary providing stripped down version of usual Linux binaries
                                  #Can configure a lot (e.g. removing binaries) compile-time
                                  #Uses musl libc (small libc) but can build with glibc (much bigger, more features) or uclibc (similar to musl)
                                  #instead

busybox                           #1MB
                                  #Docker IMAGE based on scratch, adding:
                                  #  - busybox
                                  #  - /dev:
                                  #      - std*, tty, ptmx, fd
                                  #      - null, zero, random, urandom
                                  #      - mqueue, fuse, core
                                  #  - /etc: passwd, group, shadow, localtime
                                  #  - empty /home, /root, /tmp, /usr/sbin, /var/spool/mail, /var/www
                                  #Can use tags: uclibc or glibc for different C library
                                  #Default CMD: sh

alpine                            #5MB
                                  #Docker IMAGE based on scratch, adding:
                                  #  - fundamental packages:
                                  #     - busybox
                                  #     - SysVInit
                                  #     - APK:
                                  #        - small package manager
                                  #        - automatically cleans up
                                  #     - ld: linker
                                  #     - musl libc
                                  #     - NSS, SSL: crypto
                                  #     - Zlib
                                  #  - useful utilities:
                                  #     - /etc/fstab: mounting
                                  #     - cron
                                  #     - sysctl, module-init-tools: kernel-related features
                                  #     - basic DCHP configuration
                                  #     - logrotate: log utility
                                  #     - iconv: charset conversion
                                  #     - scanelf: ELF utilities
                                  #  - in /etc/, some useful conf files:
                                  #     - profile, profile.d/:
                                  #        - shell startup files, which set ENVVAR CHARSET, PATH, PAGER, PS1
                                  #        - not read by default by Docker though
                                  #     - alpine-release, /etc/os-release: OS version
                                  #     - issue|motd: terminal welcome message
                                  #     - TZ: current timezone
                                  #     - protocols|services: URI schemes port numbers
                                  #     - securetty: possible terminals to connect to
                                  #     - shells: possible shells
                                  #  - useful empty dirs: /lib/firmware, /media/cdrom|floppy|usb, /mnt, /run, /srv, /usr/share/man, /usr/share/misc,
                                  #    /usr/local/bin|lib|share, /var/cache|lib/misc, /var/empty, /var/local, /var/log, /var|etc/opt, /var/run
                                  #  - useful symlinks: many /sbin/*, /usr/bin/*, /usr/sbin/* to /bin/busybox
                                  #Designed to run from RAM
                                  #No default CMD|ENTRYPOINT

iron/IMAGE                        #Images based on alpine, adding only:
                                  #  - ca-certificates
                                  #  - what is needed to run the language, e.g.:
                                  #     - only "apk add python" for iron/python)
                                  #     - 19MB for Node.js (runtime is 11MB, alpine 5MB)
                                  #  - no default CMD|ENTRYPOINT
                                  #Possible IMAGEs: elixir, erlang, gcc, go, java, leiningen (clojure), mono, node, perl, php, python, ruby, scala
                                  #Can use IMAGE:dev, bigger images but with dev tools to build the language from source

debian                            #Official Docker IMAGE, 123MB

buildpack-deps:curl               #Official Docker IMAGE, 167MB
                                  #Based on debian image, adds: ca-certificates, curl, wget

buildpack-deps                    #Official Docker IMAGE, 608MB
                                  #Based on buildpack-deps:curl, adds:
                                  #  - bzr, git, mercurial, svn
                                  #  - openssh
                                  #  - procps: utilities for /proc
                                  #  - build tools: automake, autoconf, g++, gcc, make, patch
                                  #  - bzip2, xz, zlib
                                  #  - file
                                  #  - imagemagick
                                  #  - libbz2-dev, libc6-dev, libcurl4-openssl-dev, libdb-dev, libevent-dev, libffi-dev, libgdbm-dev, libgeoip-dev,
                                  #    libglib2.0-dev, libjpeg-dev, libkrb5-dev, liblzma-dev, libmagickcore-dev, libmagickwand-dev,
                                  #    libmysqlclient-dev, libncurses-dev, libpng-dev, libpq-dev, libreadline-dev, libsqlite3-dev, libssl-dev,
                                  #    libtool, libwebp-dev, libxml2-dev, libxslt-dev, libyaml-dev,

DOCKER OFFICIAL IMAGES ==>        #For libraries/frameworks:
                                  #  - based on either debian or buildpack-deps
                                  #  - often those tags are present:
                                  #     - alpine: base on alpine instead. To prefer when possible
                                  #     - slim: base on buildpack-deps:curl
                                  #     - onbuild: add ONBUILD instructions, e.g.:
                                  #        - copying CONTEXT_DIR to /usr/src/app
                                  #        - installing dependencies
                                  #        - passing build args as ENVVAR (e.g. NODE_ENV)
                                  #  - as oppose to iron/IMAGEs, install more things (bigger images), but related to the library/framework
                                  #     - e.g. for node: install npm, add group|user "node", ENVVAR NPM_CONFIG_LOGLEVEL, NODE_VERSION,
                                  #       symlink nodejs -> node
                                  #For OS:
                                  #  - e.g. ubuntu, centOS
                                  #  - is usually the full OS image

                                  ┌────────────────────┐
                                  │   CONTAINER CRUD   │
                                  └────────────────────┘

CONTAINER                         #Instance of an image, meant to be run
                                  #Is either:
                                  #  - CONTAINER_ID UUID
                                  #  - CONTAINER_NAME


docker create IMAGE               #Does:
 [COMMAND [ARGS...]]              #  - if does not exist locally, docker pull IMAGE
docker-compose create|run         #  - creates a container, using IMAGE
 [IMAGE_NAME...]                  #  - does not start it yet
                                  #COMMAND: see COMMANDs section
CPSCONF.container_name
--name CONTAINER_NAME            |#Def: random
--cidfile FILE
HOSTCONF.ContainerIDFile          #Write CONTAINER_ID to FILE


docker rename CONTAINER CONTAINER2#


docker update CONTAINER...        #Only few attributes can be changed, documented elsewhere in this file


docker rm CONTAINER
docker-compose rm [IMAGE_NAME...] #Deletes a CONTAINER
-f
--force                          |#Deletes even if running


docker-gc                        ##Removes:
                                 ##  - stopped containers, if exited more than ENVVAR GRACE_PERIOD_SECONDS (def: 3600)
                                 ##  - images, if nor used by any container, and existed for more than ENVVAR GRACE_PERIOD_SECONDS
                                 ##  - related volumes
                                 ##Available as a Docker image
                                 ##Version 0.1.0

ENVVAR STATE_DIR                 ##Runtime dir (def: /var/lib/docker-gc). Must have read/write permissions
ENVVAR PID_DIR                   ##Def: /var/run. PID file is PID_DIR/dockergc. Must have read/write permissions
ENVVAR DRY_RUN=1                 ##

ENVVAR EXCLUDE_FROM_GC           ##Newline-separated file (def: /etc/docker-gc-exclude) of IMAGE_NAME to not remove (can use regex)
ENVVAR EXCLUDE_CONTAINERS_FROM_GC##Same for CONTAINER_NAME (def: /etc/docker-gc-exclude-containers)
ENVVAR EXCLUDE_DEAD=1            ##Do not remove containers with status "dead"
ENVVAR FORCE_IMAGE_REMOVAL=1     ##Even if image has multiple tags
ENVVAR FORCE_CONTAINER_REMOVAL=1 ##Even if removal created an error

ENVVAR LOG_TO_SYSLOG=1           ##
ENVVAR SYSLOG_FACILITY           ##Def: user
ENVVAR SYSLOG_LEVEL              ##Def: info
ENVVAR SYSLOG_TAG                ##Def: docker-gc

ENVVAR DOCKER                    ##docker command and flags (def: docker)

                                  ┌─────────────────────┐
                                  │   CONTAINER DEBUG   │
                                  └─────────────────────┘

docker ps                         #Prints containers with information:
docker-compose ps [IMAGE_NAME...] #  - CONTAINER_ID (truncated unless --no-trunc)
                                  #  - CONTAINER_NAME
                                  #  - IMAGE_NAME
                                  #  - IMAGE command
                                  #  - ctime
                                  #  - status: see above
                                  #  - ports forwarding
                                  #  - size: only if -s|--size
                                  #     - "real size" vs "virtual size": see below
-a
--all                             #Prints all (not only currently running)
-n [INT]
--last [INT]
-l
--latest                          #Only prints INT (def: 1) latest ran
-q                               |#
--quiet                           #Only show container ID
--format GOTMP                    #Def is DOCKERCONF.psFormat "GOTMP"
-f VAR=VAL                        #VAR:
--filter VAR=VAL                  #  - id CONTAINER_ID
                                  #  - name CONTAINER_NAME
                                  #  - ancestor IMAGE
                                  #  - before|since CONTAINER
                                  #  - status STR
                                  #  - exited NUM
                                  #  - label VAR[=VAL]
                                  #  - isolation default|process|hyperv
                                  #  - volume VOLUME|CONTAINER_DIR
                                  #  - network NETWORK

CONTAINERINFO.Id                  #CONTAINER_ID
CONTAINERINFO.Name                #CONTAINER_NAME
CONTAINERINFO|CONTAINERSPEC.Image #IMAGE_NAME
CONTAINERINFO.Created             #"DATE"
CONTAINERINFO.HostConfig          #HOSTCONF
CONTAINERINFO.SizeRootFs          #"Virtual size", i.e. size of all layers
                                  #Only if docker inspect -s|--size
CONTAINERINFO.SizeRw              #"Real size", i.e. size of current changes from last image, i.e. what would be added by docker commit
                                  #Only if docker inspect -s|--size


docker inspect CONTAINER...       #Prints CONTAINERINFO. Same options as docker inspect IMAGE
CONTAINERINFO                     #Debug information, as JSON
CONTAINERINFO.Config              #Same attributes as IMAGEINFO.Config
-f GOTMP
--format GOTMP                    #
--type image|container|task       #If there is ambiguity

                                  ┌─────────────────────┐
                                  │   CONTAINER STATE   │
                                  └─────────────────────┘

docker stop|restart CONTAINER...  #Send "stop signal" (def: SIGTERM), i.e. graceful stop
docker-compose stop|restart       #After a "stop grace period" (def: 10 secs), sends SIGKILL, i.e. force stop
 [IMAGE_NAME...]                  #If restart, runs docker start right after
-t INT
--time INT
docker service start ...
--stop-grace-period INT
CONTAINERSPEC.StopGracePeriod
docker-compose
 up|restart|scale|stop ...
-t NUM
--timeout NUM                     #Stop grace period

docker create ...
--stop-signal SIGNAL_NAME
CPSCONF.stop_signal               #"stop signal"
STOPSIGNAL SIG_NAME|NUM           #Last is Dockerfile instruction.


docker start CONTAINER...
docker-compose start [IMAG_NAM...]#Runs a stopped CONTAINER


docker kill CONTAINER...
docker-compose kill [IMAGE_NAM...]#Send SIGKILL, i.e. force stop
-s SIGNAL                        |#
--signal SIGNAL                   #


docker pause CONTAINER...
docker-compose pause [IMAG_NAM...]#Similar to sending SIGSTOP, i.e. pause (like CTRL-Z), but actually use control groups "freeze" feature


docker unpause CONTAINER...
docker-compose unpause
 [IMAGE_NAME...]                  #Similar to sending SIGCONT, i.e. unpause, but actually use control groups "freeze" feature


CONTAINERINFO.State.Status        #Can be:
                                  #  - created: after docker create
                                  #  - running: after docker start
                                  #  - paused: after docker pause
                                  #  - restarting: during restarting (see --restart)
                                  #  - exited
                                  #  - dead: trying to kill|stop, and it failed, so cannot restart
CONTAINERINFO.Running|Paused|
 Restarting|OOMKilled|Dead        #BOOL
SYSINFO.Containers.
 Running|Paused|Stopped           #NUM
CONTAINERINFO.State.
 StartedAt|FinishedAt             #"DATE"

                                  ┌──────────┐
                                  │   EXIT   │
                                  └──────────┘

docker exec EXIT CODE ==>         #Is:
DOCKERINFO.State.ExitCode         #  - 1: cannot connect to dockerd
DOCKERINFO.State.Error            #  - 125: dockerd error
                                  #  - 126: cannot run COMMAND
                                  #  - 127: cannot find COMMAND
                                  #  - otherwise: COMMAND exit code

docker wait CONTAINER...          #Waits until CONTAINER stops, then prints exit code


docker create|update ...
--restart STR                     #What happens when container exits:
CPSCONF.restart                   #  - "no" (def): nothing
                                  #  - "always": restarts
                                  #  - "on-failure[:NUM]": restarts if exit code non-0, with NUM max retries (def: unlim)
                                  #  - "unless-stopped": restarts unless explicitely stopped by admin
                                  #Restarts use exponential delay:
                                  #  - start at "delay" (def: 100ms)
                                  #  - multiply by 2 each time
                                  #  - for a maximum of "window" (def: unlim)
                                  #Should not be used if a process manager is used, e.g. systemd, forever or pm2
                                  #Always restart detached (see --detach)
docker service create ...
--restart-condition STR
HOSTCONF.RestartPolicy.Name
TASKIMPIFO.RestartPolicy.Condition#Same with none, any or on-failure
--restart-max-attempts NUM
HOSTCONF.RestartPolicy.
 MaximumRetryCount
TASKIMPINFO.RestartPolicy.Attempts#Like NUM above for "on-failure"
--restart-delay NUM
TASKIMPINFO.RestartPolicy.Delay   #Like "delay" above
--restart-window NUM
TASKIMPINFO.RestartPolicy.Window  #Like "window" above
CONTAINERINFO.RestartCount        #NUM


docker run ...
docker compose run ...
--rm                             |#When exiting, remove:
HOSTCONF.AutoRemove              |#  - volumes, except if specific VOLUME_NAME was given
                                 |#  - container filesystem
                                 |#Pros: clean up space
                                 |#Cons: cannot inspect them after container exit (for debugging)
                                 |#Cannot be used with --detach


dockerd ...
--live-restore                    #Do not shut down containers if server goes down
                                  #Server must be restarted with same options
                                  #While down, clients will buffer communication to server until limit (def: 64K)
                                  #Not compatible with swarm mode

                                  ┌─────────────────┐
                                  │   HEALTHCHECK   │
                                  └─────────────────┘

HEALTHCHECK [--OPT] CMD COMMAND   #First is Dockerfile instruction.
                                  #Adds a "health status" to a CONTAINER, in addition to its running status:
                                  #  - checked by COMMAND at regular intervals
                                  #  - COMMAND exit code must be 0 (success) or 1 (failure)
                                  #  - COMMAND stdout|stderr will be kept in logs
                                  #Can be inspected with:
                                  #  - docker inspect, ps, etc.: see below
                                  #  - health_status event (with "docker events")
                                  #Used by:
                                  #  - swarm (to maintain number of replicas)
                                  #Only last HEALTHCHECK will be used
--interval DUR                    #Def: 30s
--timeout DUR                     #Def: 30s
--retries NUM                     #Def: 3

docker create ...
--health-cmd CMD
IMAGEINFO.Config.Healthcheck.Test
--health-interval DUR
IMAGIF.Config.Healthcheck.Interval
--health-timeout DUR
IMAGINF.Config.Healthcheck.Timeout
--health-retries NUM
IMAGINF.Config.Healthcheck.Retries#

HEALTHCHECK NONE
docker create ...
--no-healtcheck                   #

CONTAINERINFO.State.Health.Status #"healthy" or "unhealthy"
CONTAINERINFO.State.Health.
 FailingStreak                    #NUM
CONTAINERINFO.State.Health.Log    #OBJ_ARR: Start|End "DATE", ExitCode NUM, Output STR



dockerd ...
--cluster-opts
 discovery.heartbeat=NUM
docker swarm init ...             #Frequency of healthchecks to nodes, in overlay network
--dispatcher-heartbeat DUR        #In secs, def: 20
--cluster-opts discovery.ttl=NUM  #How long before a node is considered unhealthy by healthcheck, in overlay network
                                  #In secs, def: 60

                                  ┌──────────────┐
                                  │   COMMANDS   │
                                  └──────────────┘

COMMAND                           #Means a CLI command, either:
                                  #  - same syntax as in a CLI
                                  #     - spawned in a subprocess
                                  #        - shell specified with SHELL ["COMMAND",...]
                                  #           - def: ["/bin/sh", "-c"]
                                  #        - run in background
                                  #           - not terminated when parent is (e.g. with docker stop)
                                  #           - parent signals not propagated
                                  #     - can use trailing backslashes for multiline
                                  #     - preferred for RUN
                                  #  - as JSON array ["STR",...]
                                  #     - run in same process
                                  #     - no shell
                                  #     - preferred for CMD|ENTRYPOINT
DL4005                           ##Use SHELL when needed

CHAINING ==>                      #Since each command creates a new layer, should chain commands, e.g.:
                                  #  - RUN printf a > a \n RUN rm a: first layer is 1 byte, second 0 bytes
                                  #  - RUN printf a > a && rm a: only one layer, 0 bytes
                                  #Exit code is of the last command
                                  #  - i.e. should use && instead of ;

PACKAGE INSTALLATION ==>          #Containers are always unprivileged:
                                  #  - can do apt-get install -y
                                  #  - but apt-get upgrade will fail on some core packages
                                  #How to install packages:
                                  #  apt-get update &&
                                  #  apt-get install -y --no-install-recommends PACKAGE=VERSION && (version pinning to avoid unpredictability)
                                  #  apt-get clean && rm -rf /var/lib/apt/lists/* (remove apt-get update footprint, so it does not take up space)
DL3005                           ##Avoid apt-get upgrade or dist-upgrade
DL3014                           ##Use apt-get install -y
DL3015                           ##Use apt-get install --no-install-recommends
DL3008|3013                      ##Use apt-get|pip install PACKAGE=VERSION, not PACKAGE
DL3009                           ##Use apt-get clean && rm -rf /var/lib/apt/lists/*


RUN COMMAND                       #Dockerfile instruction. Run command, compile-time
                                  #If COMMAND exit code !== 0, stop build
DL3001                           ##Avoid COMMAND which do no make sense in a container, e.g. interactive or host-controlling (shutdown, ps, kill, etc.)
DL4001                           ##Either use wget or curl, but not both

CMD COMMAND
CPSCONF.command COMMAND           #Dockerfile instruction.
IMAGEINFO.Config.Cmd              #Run command, runtime.
CONTAINERINFO.Path                #Sets default command + args
CONTAINERSPEC.Command             #Only last CMD will be used.
CONTAINERINFO|CONTAINERSPEC.Args  #At least one CMD or ENTRYPOINT required per Dockerfile
DL4003                           ##Do not define multiple CMD

ENTRYPOINT COMMAND                #Dockerfile instruction.
docker create ...                 #If COMMAND uses:
docker compose run ...            #  - CLI syntax: like CMD
--entrypoint COMMAND              #  - JSON array syntax:
CPSCONF.entrypoint                #     - sets default command, that can take args
IMAGEINFO.Config.Entrypoint       #     - CMD now sets default args (not default command), and must use JSON array syntax
                                  #Only last ENTRYPOINT will be used.
                                  #At least one CMD or ENTRYPOINT required per Dockerfile
DL4004                           ##Do not define multiple ENTRYPOINT


docker create IMAGE [...]         #If IMAGE:
                                  #  - can take args (i.e. uses ENTRYPOINT [+ CMD]):
                                  #     - runs default command
                                  #     - ... are extra arguments (def: CMD)
                                  #  - otherwise (i.e. uses only CMD):
                                  #     - ... is command + arguments (def: CMD)

docker run IMAGE [...]            #Does:
docker-compose run IMAGE_NAME     #  - docker create -a stdout -a stderr IMAGE ...
 [COMMAND [ARGS...]]              #  - docker start CONTAINER
                                  #Shares all options from docker create+exec, plus few extra, specified in this doc.

docker exec CONTAINER COMMAND
 [ARGS...]
docker-compose exec IMAGE_NAME    #Run COMMAND [ARGS...] from within the container
 COMMAND [ARGS...]                #CONTAINER must be running


CONTAINERINFO.ExecIDs             #Linux kernel syscall "exec" IDs

                                  ┌──────────────────────┐
                                  │   STANDARD STREAMS   │
                                  └──────────────────────┘

docker create ...
-a stdin|stdout|stderr            #Redirects COMMAND's standard streams to|from current process|terminal
--attach stdin|stdout|stderr      #Can be done several time.
IMAGEINFO.Config.                 #Def:
 AttachStdin|Stdout|Stderr        #  - docker exec: stdin+stdout+stderr
                                  #  - docker run: stdout+stderr
                                  #  - docker start: none
                                  #docker create -a seems to have no effect (overriden by docker start), but not docker run
                                  #COMMAND will remain open if waiting on stdin
docker start ...
-a
--attach                          #Same as -a stdin -a stdout -a stderr --sig-proxy=true
docker start|exec ...
docker-compose exec|run|up ...
-d                               |#
--detach                          #Opposite of --attach

docker exec|start|attach ...
--detach-keys "KEY,..."           #Sequence of keys to put currently foreground container to background
DOCKERCONF.detachKeys             #Def: "ctrl-p,ctrl-q"

docker attach CONTAINER           #Like --attach, but for a running container, which might be in another terminal|process (or not)
--no-stdin                        #Attach stdout|stderr, but not stdin


docker create|exec ...
docker-compose create|exec ...
-t
--tty                             #Use a pseudo-TTY. Required if starting interactive shell
CPSCONF.tty                       #Is def with docker-compose create|exec, not def with docker create|exec
IMAGEINFO.Config.Tty              #Does not have impact on standard streams redirections
-T                               !#Inverse

HOSTINFO.ConsoleSize              #TTY size, e.g. used to format console output
                                  #[NUM, NUM2]. Only for Windows
                                  #Can be resized, but only through REST API

docker create|exec|start ...
-i
--interactive
CPSCONF.stdin_open                #Similar to --attach, but meant for interactive shells:
IMAGEINFO.Config.OpenStdin        #  - does not conflict with --detach, although --detach nullifies -i
IMAGEINFO.Config.StdinOnce        #  - closes stdin after last client closes


docker run|attach ...
--sig-proxy=false                 #Do not redirect all signals from current process|terminal to the container it runs
                                  #No effect if --tty

                                  ┌────────────┐
                                  │   ENVVAR   │
                                  └────────────┘

SHELL EXPANSION ==>               #E.g. $VAR or globbing, is done only in COMMAND using CLI syntax

$VAR                              #Expands in Dockerfile VAR that was defined by ENV or ARG
${VAR}                            #Cannot be used in:
                                  #  - COMMAND-related: CMD, RUN, ENTRYPOINT, SHELL, HEALTHCHECK
                                  #     - but does normal shell expansion if using JSON syntax
                                  #  - ARG
                                  #  - MAINTAINER
                                  #Should not be used for confidential information, as docker history shows it
${VAR:-VAL}
${VAR:+VAL}                       #Like in Bash


ENV VAR VAL
ENV VAR=VAL ...
docker create ...
docker-compose run ...
-e ENVVAR=VAL
--env ENVVAR=VAL
CPSCONF.environment              |#
IMAGEINFO.Config.ENV              #Sets ENVVAR at build time + runtime.
CONTAINERSPEC.Env                 #First two are Dockerfile instruction. First one does not parse/expanse VAL
--env-file FILE
CPSCONF.env_file                  #Same with newline-separated ENVVAR=VAL file (def: ./.env)


ARG VAR[=VAL]                     #Dockerfile instruction.
                                  #Like ENV but:
                                  #  - added as environment variable only at build time, not runtime
                                  #  - can be set using docker build --build-arg VAR=VAL
                                  #  - VAL is default value
                                  #Information is not persisted in final built IMAGE. If needs to persist, can put ARG variable inside an ENV
docker build ...
--build-arg VAR=VAL
CPSCONF.build.args                #Provides ARG

                                  ┌────────────────┐
                                  │   FILESYSTEM   │
                                  └────────────────┘

ISOLATION ==>                     #Container cannot read nor write host's filesystem

docker create ...
--read-only
CPSCONF.read_only
HOSTCONF.ReadonlyRootfs           #Mount main partition as readonly


BUILD CONTEXT ==>                 #BUILD_DIR:
                                  #  - local directory, used neither at build-time nor runtime
                                  #  - specified by docker build
                                  #  - if targeting a Dockerfile directly (e.g. using stdin), no BUILD_DIR
                                  #CONTEXT_DIR:
                                  #  - temporary directory, only used at build-time
                                  #  - copied from BUILD_DIR
                                  #  - sent by client to server:
                                  #     - should keep it minimal
                                  #  - meant to be used by Dockerfile instructions COPY|ADD to copy to IMAGE_DIR
                                  #  - does not copy files matching BUILD_DIR/.dockerignore:
                                  #     - recommended
                                  #     - newline-separated, similar to .gitignore
                                  #     - # COMMENT, first line only
                                  #     - globbing: * ? ** !
                                  #IMAGE_DIR:
                                  #  - final directory, used at runtime
                                  #  - used by COMMANDs at build-time

$PWD                              #If unset (def), CONTEXT_DIR
                                  #Can only be changed by WORKDIR instruction

WORKDIR DIR
docker create ...
docker compose run ...
-w DIR                            #First is Dockerfile instruction.
--workdir DIR                    |#Changes current directory of IMAGE_DIR (def: /)
CPSCONF.working_dir              |#As opposed to "cd":
IMAGEINFO.Config.WorkingDir       #  - persisted across instructions
CONTAINERSPEC.Dir                 #  - DIR created with mkdir -p if not existing, as root
DL3000                           ##Avoid relative DIR
DL3003                           ##Use WORKDIR, not "cd" (see above)


ONBUILD [...]                     #Dockerfile instruction. Same as ... but delayed:
IMAGEINFO.Config.OnBuild          #  - fired when another Dockerfile calls FROM for this image
                                  #  - only for direct children, not grandchildren
                                  #Allows using downstream image's:
                                  #  - CONTEXTDIR: e.g. COPY . DIR, then RUN ... DIR
                                  #  - ARG|ENV

                                  ┌────────────────┐
                                  │   FILES COPY   │
                                  └────────────────┘

COPY|ADD SRC... DEST              #Dockerfile instruction. Copy files from CONTEXT_DIR to IMAGE_DIR
COPY|ADD ["SRC",..., "DEST"]      #SRC:
                                  #  - can contain globbing * ?
                                  #  - cannot be outside of CONTEXT_DIR
                                  #DEST:
                                  #  - must include trailing / if want to copy inside DIR
                                  #  - if not existing, is created using mkdir -p
                                  #New files/directories created with root user|group
                                  #ADD has extra features:
                                  #  - SRC can be URL
                                  #     - if URL that is an archive:
                                  #        - prefer RUN curl && tar
                                  #        - over ADD && RUN tar
                                  #        - as it does not keep archive in extra layer, so is smaller
                                  #  - SRC can be a *.tar (unless it is a URL), which is unpacked
--chown=USER:GROUP                #Of the destination files.
                                  #Def: root
DL3010|3020                      ##Use ADD if SRC is archive|URL, COPY otherwise

docker cp                         #Copy files recursively
[CONTAINER:]PATH [CONTAINER:]PATH2#Permissions are kept
                                  #Can be:
                                  #  - container -> host: user|group will be (host's) current's
                                  #  - host -> container: user|group is (container's) root
                                  #PATH can be - for stdin, which can be .tar archive
                                  #PATH in containers is relative to BUILD_DIR
-L
--follow-link                     #Follow symlinks, i.e. copy symlink target, not symlink itself


docker export CONTAINER           #Same as docker cp CONTAINER:/ stdout except it:
                                  #  - must be redirected, or use -o|--output FILE
                                  #  - is .tar compressed
                                  #See also docker import

docker save IMAGE...              #Similar as docker export, but for an IMAGE
                                  #As opposed to docker export, includes all IMAGE information and metadata, not only set of files

                                  ┌─────────────┐
                                  │   VOLUMES   │
                                  └─────────────┘

DATA VOLUME ==>                   #Container directory that is connected to host, i.e.:
                                  #  - synced (bidirectional) with a directory of the host
                                  #     - must ensure that operations are atomic (to avoid filesystem conflicts)
                                  #     - several containers can share same host directory, by specifying same HOST_DIR
                                  #  - not saved in images nor container layers
                                  #     - should be used for any data not meant to be persisted in an image, e.g. temp runtime data
                                  #  - faster performance because do not use storage driver
HOST_DIR                          #Can be:
                                  #  - absolute path:
                                  #     - specific path, random VOLUME_NAME
                                  #     - cannot be manipulated with "docker volume"
                                  #     - called "bind mount"
                                  #     - can create portability problem (path must exist, users/groups)
                                  #  - [[:alnum:]_.-] VOLUME_NAME:
                                  #     - somewhere in DOCKERDIR, specific VOLUME_NAME
                                  #     - called "named volume"
                                  #  - nothing:
                                  #     - somewhere in DOCKERDIR, random VOLUME_NAME
CONTAINER_DIR                     #Absolute path
FILE LINK ==>                     #HOST|CONTAINER_DIR can also be FILE:
                                  #  - similar to hardlink
                                  #  - if inode changes:
                                  #     - e.g. mv, or commands can actually do "mv", like sed -i or vim
                                  #     - the link is sometimes broken, but each side keeps its file
USERS/GROUPS ==>                  #If HOST_DIR:
                                  #  - does not exists, creates it under user|group root (same as daemon's)
                                  #  - exists, keep user|group and permissions
                                  #CONTAINER_DIR share permissions, user and group:
                                  #  - bidirectional
                                  #  - if user|group does not exist in one side, will use:
                                  #     - in host: container's user (from host's perspective)
                                  #     - in container: container's user (from container's perspective)
                                  #  - permissions check is done at host level, i.e. using container's user (from host's perspective)
                                  #     - i.e. container's user (from host's perspective) should be unprivileged (see "user namespaces")
EXISTING HOST DIR ==>             #If HOST_DIR already exist, reuses its content

DATA VOLUME DRIVER ==>            #Plugin for specific filesystems (e.g. over the network)
                                  #Def: "local"

CPSCONF ==>                       #Named volumes use CPCONF.volumes.VOLUME_NAME, i.e. CPVCONF
                                  #Others use CPSCONF.volume*
CPVCONF.external true             #Mount the volume if already existing, but do not try to create it


docker create ...
-v [HOST_DIR:]CONTAINER_DIR[:OPT] #Creates data volume.
--volume ...                      #OPT:
CPSCONF.volumes                   #  - ro|rw (def: rw): read-only|write (in container, not in host)
HOSTCONF.Binds                    #  - bind-propagation:
                                  #     - how to handle submounts replication, e.g.:
                                  #        - CONTAINER_DIR1 -> HOST_DIR1, CONTAINER_DIR1 -> HOST_DIR2
                                  #        - CONTAINER_DIR2 -> HOST_DIR1/SUBDIR
                                  #        - does CONTAINER_DIR2 -> HOST_DIR2/SUBDIR?
                                  #     - can be:
                                  #        - [r]shared: two-way replication (HOST_DIR1 <-> HOST_DIR2)
                                  #        - [r]slave: one-way replication (HOST_DIR1 -> HOST_DIR2)
                                  #        - [r]private: no replication
                                  #        - "r" is recursive
                                  #  - z|Z: used by SELinux
                                  #Can be done several times
VOLUMEINFO.Mountpoint
[S]MOUNTINFO.Source               #HOST_DIR
MOUNTINFO.Destination
SMOUNTINFO.Target                 #CONTAINER_DIR
MOUNTINFO.Mode                    #'OPT,...'
--volume-driver=DRIVER
CPSCONF.volume_driver
CPVCONF.driver
HOSTCONF.VolumeDriver
VOLUMEINFO|MOUNTINFO.Driver       #
--volumes-from CONTAINER
HOSTCONF.VolumesFrom              #Uses same -v configuration as CONTAINER
CPSCONF.volumes_from              #Same but using syntax:
                                  #  - container:CONTAINER_NAME[:OPT]
                                  #  - IMAGE_NAME[:OPT]
MOUNTINFO.RW
SMOUNTINFO.ReadOnly               #BOOL
MOUNTINFO.Propagation
SMOUNTINFO.BindOptions.Propagation#

docker service create ...
--mount volume-nocopy=BOOL        #When CONTAINER_DIR is empty and being mounted, whether to copy HOST_DIR content (def: true)
                                  #E.g. restarting containers will get their volumes content back


docker rm ...
docker-compose rm ...
-v
--volumes                        |#Removes volumes as well


docker volume create              #Creates data volume
--name VOLUME_NAME
VOLUMEINFO|MOUNTINFO.Name         #

docker volume create ...
-d DRIVER
--driver DRIVER                   #
-o OPT=VAL
--opt OPT=VAL                     #Driver-specific options
CPVCONF.driver_opts
SMOUNTINFO.VolumeOptions
VOLUMEINFO.Status                 #OBJ of DRIVER-specific parameters

VOLUME CONTAINER_DIR ...          #Dockerfile instruction
VOLUME ["CONTAINER_DIR",...]      #Similar to -v CONTAINER_DIR with docker create, but build-time


docker volume rm VOLUME_NAME      #


docker service create
--mount ATTR=VAL                  #Uses a data volume in a SERVICE. ATTR are:
                                  #  - type volume (def) + src VOLUME_NAME
                                  #  - type bind + src HOST_DIR
                                  #  - dst CONTAINER_DIR
                                  #  - volume-driver DRIVER
                                  #  - volume-opt OPT=VAL
                                  #  - readonly


docker create ...
--tmpfs CONTAINER_DIR[:OPT]       #Similar to data volumes, but with a tmpfs partition (i.e. uses RAM not host's filesystem)
CPSCONF.tmpfs                     #OPT are mount options, e.g. rw, noexec, nosuid or size


docker create ...
--device                          #Similar to volumes, but for devices (e.g. /dev/sda)
 HOST_PATH:CONTAINER_PATH[:OPT]   #OPT (def: 'rwm') are:
CPSCONF.devices                   #  - 'r' (read)
HOSTCONF.Devices                  #  - 'w' (write)
                                  #  - 'm' (mknod), i.e. create /dev/*

                                  ┌───────────────────┐
                                  │   VOLUMES DEBUG   │
                                  └───────────────────┘

docker volume ls                  #Prints available volumes: DRIVER, VOLUME_NAME
-q
--quiet                           #Only prints names
-f VAR=VAL                        #Possible VAR:
--filter VAR=VAL                  #  - driver DRIVER
                                  #  - name VOLUME_NAME
                                  #  - dangling BOOL: true means not used by any container


docker volume inspect VOLUME_NAME #Prints verbose debug information, as VOLUMEINFO
-f GOTMP
--format GOTMP                    #

IMAGEINFO.Config.Volumes          #{ CONTAINER_DIR: OBJ ... }
CONTAINERINFO.Mounts              #MOUNTINFO_ARR
CONTAINERSPEC.Mounts              #SMOUNTINFO_ARR

                                  ┌────────────────────┐
                                  │   STORAGE DRIVER   │
                                  └────────────────────┘

STORAGE DRIVER ==>                #Filesystem, handling image/container layers
                                  #Def: AUFS
                                  #Is mounted on an existing filesystem, "backing" (i.e. DOCKERDIR's)
dockerd
--storage-driver=DRIVER           #Storage driver are per daemon.
ENVVAR DOCKER_DRIVER              #Among: overlay2, aufs, btrfs, devicemapper, vfs, zfs
dockerd, docker create ...
--storage-opt VAR=VAL             #DRIVER-specific options

SYSINFO."Storage Driver"
IMAGEINFO|CONTAINERINF.GraphDriver
CONTAINERINFO.Driver              #Several info, including currently selected DRIVER and its options


CHOICE ==>                        #In summary:
                                  #  - AUFS: def, good for general purpose or many containers, bad if big files or lots of write
                                  #  - OverlayFS: similar to AUFS but faster and less stable
                                  #  - ZFS: good if many containers, less stable
                                  #  - BTRFS: good for pools of images, bad if many containers or many small/sequential writes
                                  #  - DeviceMapper: good for big files, bad if many containers
                                  #  - VFS: debugging only
AUFS ==>                          #Only with backing filesystem ext4, XFS or ZFS
                                  #Some Linux distributions do not include AUFS support, because not in Linux kernel
                                  #Features:
                                  #  - good memory use. Fast container startup. I.e.:
                                  #     - good if many containers, e.g. PaaS or general purpose
                                  #  - file-level copy-on-write (CoW) i.e. store entire files, not file diffs, i.e.:
                                  #     - bad for big files
                                  #     - bad if lots of write, because slow CoW
                                  #  - some kernel syscalls are unsupported, which might cause problems:
                                  #     - "rename": copy and unlink instead, i.e. different inode
                                  #     - "open": open("FILE", O_RDONLY) (no CoW) then open("FILE", O_RDWR) (CoW) point to different files
                                  #Union filesystem (union mount, merging layers directories)
OVERLAYFS ==>                     #Only with backing filesystem ext4 or XFS
                                  #Seen as successor of AUFS, but not completely stable yet
                                  #Union filesystem
                                  #Similar features than AUFS, but faster
ZFS ==>                           #Only with backing filesystem ZFS
                                  #Not completely stable
                                  #Features:
                                  #  - good memory use, i.e.:
                                  #     - good if many containers, e.g. PaaS
                                  #  - bad RAM usage
                                  #Storage options: see online doc
BTRFS ==>                         #Only with backing filesystem BTRFS
                                  #Features:
                                  #  - good overall performance
                                  #     - good for pools of images
                                  #  - good support for SSD drives
                                  #  - no page (i.e. part of a file) caching, i.e.:
                                  #     - bad for many containers, e.g. PaaS
                                  #  - writes can increase memory usage and fragmentation quite a lot, i.e.:
                                  #     - bad if many small writes (including changing containers running states)
                                  #  - use journaling, i.e.
                                  #     - bad performance if writes are sequential
                                  #Storage options:
                                  #  - min_space NUM[K|M|G]: minimum subvolume size
DEVICEMAPPER ==>                  #Only with backing filesystem direct-lvm
                                  #Features:
                                  #  - works with 64KB blocks not files
                                  #     - i.e. good for big files, bad for small files
                                  #  - not memory efficient
                                  #     - bad for many containers, e.g. PaaS
                                  #Storage options: see online doc
VFS ==>                           #Only for debugging


RAMDISK ==>                       #Not a STORAGE driver, but a filesystem type similar to tmpfs
                                  #When used, need to set ENVVAR DOCKER_RAMDISK

                                  ┌───────────────┐
                                  │   PROCESSES   │
                                  └───────────────┘

PROCESS ==>                       #Each container uses its own "PID namespace", i.e. process list specific to that container:
                                  #  - cannot see parent's
                                  #  - each container starts with PID 1
docker create ...
--pid STR                         #Set container's PID namespace:
CPSCONF.pid                       #  - "host": same as host's (i.e. no isolation)
HOSTINFO.PidMode                  #  - "container:CONTAINER": same as another container (bidirectional)
                                  #Def: new one
CONTAINERINFO.State.Pid           #

                                  ┌─────────┐
                                  │   IPC   │
                                  └─────────┘

IPC ==>                           #Each container uses its own "IPC namespace", i.e. list of semaphores, queues and shared memory segments
docker create ...
--ipc STR
CPSCONF.ipc
HOSTCONF.IpcMode                  #Same value as --pid

                                  ┌──────────────┐
                                  │   NETWORKS   │
                                  └──────────────┘

CPCONF.networks.NETWORK_NAME      #CPNCONF
CPNCONF.external true             #Allow using NETWORK in CPSCONF.networks if already existing, but do not try to create it


ISOLATION ==>                     #Each container uses its own network interfaces ("network namespace"):
                                  #See --network "host" to remove isolation
NETWORKSET.SandboxID|Key          #Network namespace information


dockerd ...
--default-gateway[-v6] IP         #Daemon's (not NETWORK) gateway IP


NETWORK                           #Is a set of network-related settings/resources (ports, etc.)
                                  #Can be the ID (can be truncated) or name
                                  #Default:
                                  #  - three available: none, host, bridge
                                  #  - bridge is the default associated NETWORK
                                  #Containers can:
                                  #  - be associated with several networks

DRIVER                            #Can be bridge, macvlan or overlay

BRIDGE ==>                        #Single-host inter-container communication, with single gateway
                                  #Hosts uses ethernet interface:
                                  #  - docker0 is used for the default bridge interface
                                  #  - automatically creates gateway (external single IP for the subnet)
                                  #Container uses ethernet interface:
                                  #  - called eth0, or docker network create ... -o "com.docker.network.bridge.name=NAME"
                                  #  - uses one IP among host's single subnet
                                  #     - def: automatic, with 2^16 possible IP addresses
dockerd ...
-b INTERFACE
--bridge INTERFACE
NETWORKSET.Bridge                 #Instead of docker0. Can be "none" (e.g. if NETWORK bridge is not used)

MACVLAN ==>                       #Similar to bridge, but different design, which is more performant and simpler
                                  #  - while in bridge, containers have their own interface and MAC, in macvlan, they use sub-interfaces of the
                                  #    host's interface
                                  #Containers must use same interface as host:
                                  #  - specified with NETWORK option parent=INTERFACE

OVERLAY ==>                       #Multi-host inter-container communication, with single gateway ("advertiser")
                                  #  - connected together using a key-value store
                                  #  - hosts must have unique hostnames
                                  #Key-value store:
                                  #  - supported: consul, etcd, zookeeper
                                  #  - must open ports 4789 (UDP) and 7946 (TCP/UDP)
                                  #Can have multiple subnets, gateways, etc. (by specifying several times the option)
                                  #OPT:
                                  #  - encrypted: use IPSec (port 50 must be opened)
                                  #With swarm:
                                  #  - does not need key-value store
                                  #  - can be assigned to SERVICE, which will be applied to every node using the SERVICE
dockerd ...
--cluster-opts kv.path=PATH       #Namespace to prepends to all keys in key-value store
                                  #Def: docker/nodes
--cluster-store PROVIDER://URL    #
--cluster-advertise IP:PORT       #Advertiser
--cluster-store-opts
 OPT_VAR=OPT_VAL,...              #


docker network create NETWORK_NAME#Creates NETWORK
NETWORKINFO.Id
NETWORKSSET.NetworkID             #NETWORK_ID
NETWORKINFO|CSET.Name             #NETWORK_NAME
-d DRIVER
--driver DRIVER
CPNCONF.driver
NETWORKINFO.Driver                #Def: bridge
-o VAL                            #DRIVER-specific options
--opt VAL                         #DRIVER name is included in VAL
CPNCONF.driver_opts               #Note:
NETWORKINFO.Options               #  - those options are for new NETWORK, not default ones
                                  #  - there usually are corresponding flags for default NETWORK
                                  #     - e.g. --ip-masq is for default bridge NETWORK, -o "com.docker.network.bridge.enable_ip_masquerade" for
                                  #       custom ones
--internal
NETWORKINFO.Internal              #No external access, but still inter-container connectivity
--ipv6
NETWORKINFO.EnableIPv6            #Allows IPv6
--subnet=IP/MASK                  #Specifies subnet (instead of default)
--gateway=IP
NETWORKS[S]ET.[IPv6]Gateway       #Specifies gateway (instead of default)
--ip-range=IP/MASK                #Specifies IP range, i.e. subset of subnet from which containers IPs will be picked (def: whole subnet)
--aux-address="VAR=IP"
NETWRKSET.SecondaryIP[v6]Addresses#Specifies secondary address

dockerd ...
--ipv6                            #Same as docker network create --ipv6, but for docker0 interface
--bip CIDR                        #Same as docker network create --subnet, but for docker0 interface
--fixed-cidr[-v6] CIDR            #Same as docker network create --ip-range, but for docker0 interface

docker network create ...
-o "com.docker.network.bridge.
 enable_ip_masquerade"
dockerd ...                       #Enable IP masquerading, i.e. containers do not have to have a public IP to communicate outside of NETWORK:
--ip-masq                         #they will use host's IP instead
--ip-forward                      #Enable IP forwarning

--ipam-driver IPAMDRIVER
CPNCONF.ipam.driver               #Def: "default"
--ipam-opt VAR=VAL                #
CPNCONF.ipam.config
NETWORKSSET.IPAMConfig
NETWORKINFO.IPAM                  #OBJ

docker network create ...
-o "com.docker.network.
 driver.mtu=NUM" dockerd ...
--mtu NUM                         #Set the containers network MTU (max packet size) (def: 1500)

docker network create ...
-o "com.docker.network.bridge.
 enable_icc=BOOL"
dockerd ...
--icc BOOL                        #Enable|disable communication between containers


docker network rm NETWORK         #


docker network connect NETWORK
 CONTAINER                        #Associate a CONTAINER to a NETWORK
NETWORKINFO.Containers.CONTAINR_ID#NETWORKCSET
docker network connect ...
docker create ...
--ip[6] IP
CPSCONF.networks.NETWORK.
 ipv4|6_address
NETWORKS[S]ET.IPAddress
NETWORKCSET.IPv4|6Address
NETWORKS[S]ET.IPPrefixLen
NETWORKS[S]ET.GlobalIPv6Address
NETWORKS[S]ET.GlobalIPv6PrefixLen
NODEINFO.ManagerStatus.Addr       #Specifies Ethernet interface's IP (instead of random one from subnet)
--link-local-ip IP
NETWORKSET.LinkLocalIPv6Address
NETWORKSET.LinkLocalIPv6PrefixLen #Same for link local IP
docker create ...
--mac-address STR
CPSCONF.mac_address               #Same for MAC address
NETWORK[S|C]SET.MacAddress        #Incompatible with --network host|CONTAINER

docker create ...
--network STR                     #Associate to network STR:
CPSCONF.network_mode              #  - none: no networking
HOSTCONF.NetworkMode              #  - host:
                                  #     - same as host's
                                  #     - i.e. less isolation (insecure) but much faster
                                  #  - container:CONTAINER:
                                  #     - same as container's
                                  #     - with Compose, use service:IMAGE_NAME instead
                                  #  - bridge: create and use new NETWORK of type "bridge"
                                  #  - network:NETWORK: use existing one
CPSCONF.networks                  #Same as CPSCONF.network_mode "network:NETWORK", but as NETWORK_ARR


docker network disconnect NETWORK
 CONTAINER                        #Dissociate a CONTAINER to a NETWORK
-f
--force                           #Even if running container

                                  ┌───────────────────┐
                                  │   NETWORK DEBUG   │
                                  └───────────────────┘

docker network ls                 #Prints available networks: ID, name, driver, scope
-q
--quiet                           #Only show IDs
--no-trunc                        #Do not truncate IDs
-f VAR=VAL                        #Possible VAR:
--filter VAR=VAL                  #  - id NETWORK_ID
                                  #  - name NETWORK_NAME
                                  #  - driver DRIVER
                                  #  - type custom|builtin
                                  #  - label VAR[=VAL]


docker network inspect NETWORK    #Prints verbose debug information, as NETWORKINFO
-f GOTMP
--format GOTMP                    #
CONTAINERINFO.NetworkSettings     #NETWORKSET
CONTAINERINFO.Networks.NETWORK    #NETWORKSSET

ENDPOINT ==>                      #Connection of a CONTAINER to a NETWORK
NETWORK[S|C]SET.EndpointID        #

                                  ┌───────────┐
                                  │   PORTS   │
                                  └───────────┘

PORT FORWARDING ==>               #Only works with default NETWORK
                                  #This works with Docker appending rules to iptables
dockerd ...
--iptables=false                  #Do not allow Docker to modify iptables, i.e. must manually modify it to get port forwarding working
--userland-proxy=false
NETWORKSET.HairpinMode            #Disable using hairpin NAT when modifying iptables


docker create ...
docker-compose run ...
-p [HOST_IP:][HOST_PORT:]        |#Forward ports
 CONTAINER_PORT[/PROTO]          |#*_PORT can be a range of ports instead (def: ephemeral port range, i.e. 32768-61000)
--publish ...                    |#HOST_IP (def: see all)
CPSCONF.ports                    |#  - can change default with: docker network create ... -o "com.docker.network.bridge.host_binding_ipv4=HOST_IP" or dockerd ... --ip HOST_IP
                                 |#PROTO: upd|tcp (def: any)
-P
--publish-all
HOSTCONF.PublishAllPorts          #Forward any exposed CONTAINER_PORT to a random HOST_PORT (ephemeral port range)
docker-compose run ...
--service-ports                   #Same

EXPOSE PORT ...
docker create ...
--expose PORT
CPSCONF.expose                    #First is Dockerfile instruction.
DL3011                           ##PORT number should be valid


docker port CONTAINER
 [HOST_PORT[/PROTO]]
docker-compose port IMAGE_NAME
 HOST_PORT [--protocol=PROTO]     #Show CONTAINER_PORT
HOSTCONF.PortBindings             #{ CONTAINER_PORT/PROTO: OBJ_ARR }, with OBJ: { HostPort: HOST_PORT }
NETWORKSET.Ports                  #OBJ

                                  ┌──────────────┐
                                  │   HOSTNAME   │
                                  └──────────────┘

ISOLATION ==>                     #Each container uses its own "UTS namespace", i.e. its own hostname
docker create ...
--uts STR                         #Set container's UTS namespace:
HOSTCONF.UTSMode                  #  - "host": same as host's (i.e. no isolation)

docker network connect ...
-h HOST
--hostname HOST
CPSCONF.hostname
SYSINFO.Name                      #Specifies hostname (see UTS namespace above)
IMAGEINFO.Config.Hostname         #Incompatible with --network CONTAINER
NODEINFO.Description.Hostname     #Uses /etc/hostname
CONTAINERINFO.HostnamePath        #Host's path to container's /etc/hostname

                                  ┌─────────┐
                                  │   DNS   │
                                  └─────────┘

DNS ==>                           #When inter-container communication is possible, can use DNS names, within same NETWORK:
                                  #  - CONTAINER_NAME:
                                  #     - providing it is not the default bridge NETWORK
                                  #  - DNS_ALIAS: see below

docker network connect ...
--link CONTAINER2:DNS_ALIAS
docker create
--link CONTAINER2:DNS_ALIAS
HOSTCONF|NETWORKSSET.Links        #One CONTAINER defines DNS_ALIAS to refer to another CONTAINER2
CPSCONF.[external_]links          #CPSCONF.links (not "external_links") also imply CPSCONF.depends_on
docker rm ...
--link CONTAINER2:DNS_ALIAS       #Remove DNS alias (not container itself)

docker network connect ...
--alias DNS_ALIAS
docker create ...                 #One CONTAINER2 tells any other CONTAINER the DNS_ALIAS to refer to itself
--network-alias DNS_ALIAS         #Several containers can have same DNS_ALIAS:
CPSCONF.networks.NETWORK.aliases  #  - only one will be targeted (always the same, i.e. the first one)
NETWORKSSET.Aliases               #  - others behave as passive failover

CPSCONF.domainname
IMAGEINFO.Config.Domainname       #

docker create ...
--add-host=STR
CPSCONF.extra_hosts               #Appends STR to /etc/hosts
HOSTCONF.ExtraHosts               #Incompatible with --network CONTAINER
CONTAINERINFO.HostsPath           #Host's path to container's /etc/hosts


DNS SERVER ==>                    #By default, same as host's, but can alternative specify DNS server:
                                  #  - with the following options, which update /etc/resolve.conf
                                  #  - incompatible with --network CONTAINER
docker create ...
dockerd ...
--dns IP
CPSCONF.dns
HOSTCONF.Dns                      #
--dns-search DOMAIN
CPSCONF.dns_search
HOSTCONF.DnsSearch                #
--dns-opt OPT
HOSTCONF.DnsOpt                   #
CONTAINERINFO.ResolveConfPath     #Host's path to container's /etc/resolve.conf

                                  ┌─────────┐
                                  │   TLS   │
                                  └─────────┘

dockerd|docker|docker-compose ... #dockerd is for client to authenticate server, docker is inverse
                                  #Should run on port 2376 (instead of default 2375)
--tls                             #Uses TLS for self
--tlsverify
ENVVAR DOCKER_TLS_VERIFY=1        #Uses TLS for self and other endpoint
--tlscacert=FILE                  #Def: public CA list
--tlscert=FILE                    #
--tlskey=FILE                     #
--skip-hostname-check            !#

ENVVAR DOCKER_CERT_PATH           #To override certificates|keys directory

ENVVAR COMPOSE_TLS_VERSION       !#Among "TLSv1" (def), "TLSv1_1", "TLSv1_2"


dockerd ...
--cluster-opts kv.cacertfile|
 certfile|keyfile=PATH            #For TLS, with overlay network

                                  ┌──────────────────┐
                                  │   USERS/GROUPS   │
                                  └──────────────────┘

CONTAINER USER|GROUP              #Is root (i.e. same as daemon's), unless using "user namespaces":
(FROM HOST'S PERSPECTIVE) ==>     #  - it will be sub-users|groups from a designated user instead
                                  #     - sub-users|groups share the user's permissions
                                  #     - the user can be anyone:
                                  #        - does not have to be the one controlling docker client
                                  #        - should have restricted permissions
                                  #     - goal is security:
                                  #        - e.g. volumes CONTAINER_DIR will use host's unprivileged user
                                  #  - "user namespace" is map between user|group and range of possible "sub-users|groups":
                                  #     - host must set /etc/subuid and /etc/subgid:
                                  #        - newline-delimited ranges: USER|GROUP:MIN_ID:MAX_ID
                                  #     - docker only uses first UID|GID from sub-ids range, i.e. all containers will share same subuid
                                  #  - disabled by default
                                  #Conflicts with docker create:
                                  #  - --pid|network host
                                  #  - --privileged, unless --userns host
                                  #  - --read-only
dockerd ...
--userns-remap                    #Enables user namespaces using USER|GROUP's sub-users|groups
 [USER|UID[:GROUP|GID]]           #If "default":
                                  #  - uses USER "dockremap"
                                  #  - creates that user if not existing
                                  #  - automatically edits /etc/subuid and /etc/subgid
docker create ...                 #Same value as --pid, i.e.:
--userns STR                      #  - nothing (def): use a new "user namespace" for container
HOSTCONF.UsernsMode               #  - --userns container:CONTAINER_ID: share between containers
                                  #  - --userns host: nullifies everything, since container use same "user namespace" as its host


CONTAINER USER|GROUP              #Default user|group is root
(FROM CONTAINER'S PERSPECTIVE) ==>#But containers usually do not require root access, so should use unprivileged user|group instead
USER STR
docker create|exec ...
docker-compose exec|run ...
-u USER|UID[:GROUP|GID]
--user USER|UID[:GROUP|GID]      |#
CPSCONF.user
IMAGEINFO.Config.User
CONTAINERSPEC.User                #First one is Dockerfile instruction, which is used not only runtime, but also in following instructions, e.g. COMMANDs
DL3002                           ##Avoid switching to USER root
DL3004                           ##Avoid sudo

docker create ...
--group-add GROUP
HOSTCONF.GroupAdd                 #Add GROUP to container's user's groups


DAEMON USER ==>                   #Server must be run as root user
SYSINFO.Username                  #

DAEMON GROUP ==>                  #Server group def is 'docker' if it exists, 'root' otherwise.
dockerd --group|-G GROUP          #When using Unix socket:
                                  #  - will be owned by daemon user|group
                                  #  - i.e. should use 'docker' GROUP, so that client can connect to socket without being root
                                  #     - however, access to socket still means can do anything to dockerd

                                  ┌──────────────┐
                                  │   SECURITY   │
                                  └──────────────┘

CONTAINER CAPABILITIES ==>        #Capabilities are kernel features available to container's control group.
                                  #Most capabilities are disabled by default
                                  #See online doc for list of capabilities
docker create ...
--cap-add|drop VAL
HOSTCONF.CapAdd|CapDrop           #Add|remove capabilities
CPSCONF.cap_add|drop              #Can be ALL, for all capabilities but MKNOD
docker create|exec ...
docker-compose exec ...
--privileged                     |#
CPSCONF.privileged                #
HOSTCONF.Privileged               #Add most capabilities
                                  #To avoid


docker create ...
--security-opt="no-new-privileges"#Do not allow adding privileges, e.g. through sudo


dockerd ...
--selinux-enabled                 #Enable SELinux
docker create ...
--security-opt=
 "label=user|role|type|level:VAL"
--security-opt="label=disable"    #SELinux options
CONTAINERINFO.
 MountLabel|ProcessLabel          #

docker create ...
--security-opt="apparmor=PROFILE"
CONTAINERINFO.AppArmorProfile     #Apparmor options

docker create ...
--security-opt=
 "seccomp=unconfined"
--security-opt="seccomp=PROFILE"  #Seccomp options

CPSCONF.security_opt              #
SYSINFO."Security options"        #
HOSTCONF.SecurityOpt              #STR_ARR

                                  ┌──────────────────────────────┐
                                  │   SECURITY STATIC ANALYSIS   │
                                  └──────────────────────────────┘

DOCKER SECURITY SCANNING ==>      #Automatic security static analysis of Docker images
                                  #Checks for CVE
                                  #Only for private repositories on Docker cloud or Docker Hub

clair                            ##Security static analysis of Docker|rkt containers
                                 ##Checks for CVE, using Debian, Ubuntu, Red Hat and NIST's CVE databases
                                 ##Also available as Docker image
                                 ##Version 1.2.6

docker-bench-security            ##Security static analysis of Docker containers
                                 ##E.g. wrong configuration
                                 ##Also available as Docker image
                                 ##Version 1.12.3
-l OUTPUT_FILE                   ##Def: stdout

                                  ┌─────────────────┐
                                  │   PERFORMANCE   │
                                  └─────────────────┘

CPU/MEMORY ==>                    #Close to native

I/O ==>                           #I/O can be slow, because using storage driver (i.e. union filesystems) instead of normal filesystems
                                  #Can fix it by using data volumes (but portability and distributed issues)

NETWORK ==>                       #IP/port translation can be slow, especially in network latency
                                  #Can fix it with --net=host (but security issue)

MEMORY AND SWAP ACCOUTING ==>     #Must be enabled on the OS: performance impact, but better OS memory management
                                  #See online doc for how to enable it

                                  ┌────────────────────┐
                                  │   LIMITS GENERAL   │
                                  └────────────────────┘

docker create|build ...
--ulimit NAME=NUM[:NUM2]
CPSCONF.ulimits.NAME              #Sets ulimit.
HOSTCONF.Ulimits                  #NUM is soft limit, NUM2 hard limit.
dockerd ...
--default-ulimit ...              #Default for docker create --ulimit


CONTROL GROUPS ==>                #Ensures for each process (i.e. container), at kernel level:
                                  #  - resource (e.g. CPU, memory, I/O) limiting
                                  #  - resource prioritization, e.g. one container should get more CPU
                                  #  - logging/monitoring
                                  #  - freezing processes
                                  #Security-wise: this mitigates DDoS, etc.
                                  #Can be hierarchical
                                  #Limits:
                                  #  - automatically creates a control group
                                  #     - --cgroup-parent uses a specific control group instead
                                  #  - NUM can be -1, i.e. infinity (usually def)

dockerd ...
docker create|build ...
--cgroup-parent CGROUP            #Assigns a specific control group to the container.
CPSCONF.cgroup_parent             #If /CGROUP, is under root cgroup. If CGROUP, is under daemon cgroup
HOSTCONF.Cgroup[Parent]           #Def: /docker for fs cgroup, system.slice for systemd cgroup

                                  ┌───────────────────┐
                                  │   LIMITS MEMORY   │
                                  └───────────────────┘

docker create|update|build ...
-m NUM[b|k|m|g]
--memory=NUM[b|k|m|g]
CPSCONF.mem_limit
HOSTCONF.Memory
docker service create ...
--limit-memory NUM[b|k|m|g]       #Memory hard limit. Min: 4M.
docker create|update|build ...
--memory-swap=NUM[b|k|m|g]        #Memory + Swap hard limit
CPSCONF.memswap_limit             #Def: double of --memory
HOSTCONF.MemorySwap               #When set, --memory must be set docker create ...
docker create|update|build ...
--kernel-memory=NUM[b|k|m|g]      #Memory hard limit, but only the one used by kernel (includes sockets buffer, process stack, slabs).
HOSTCONF.KernelMemory             #Min: 4M.
                                  #When set, --memory must be set
--memory-reservation=NUM[b|k|m|g]
docker service create ...
--reserve-memory NUM[b|k|m|g]
HOSTCONF.MemoryReservation
TASKTMPINFO.Resrouces.Reservation.#Memory soft limit (i.e. only hint, but not enforce limit)

 MemoryBytes                      #If 0 (def), same as --memory
docker create|build ...
--oom-kill-disable=BOOL           #Enable OOM killer (def: true)
HOSTCONF.OomKillDisable           #OOM (out-of-memory) killer:
                                  #  - kernel terminates a process (here the container) that requested memory while none is either available or above memory hard limit
                                  #  - disabling OOM killer for the container does not disable host's OOM killer
                                  #     - i.e. it might dangerously force killing host's system processes, unless --memory is set
--oom-score-adj=-1000-1000        #Sets OOM preference, i.e. container with lower preference will be first to be OOM killed
HOSTCONF.OomScoreAdj              #Can be set with dockerd as well

--memory-swappiness=0-100         #How much memory pages should be swapped to cache (as opposed to not cached)
HOSTCONF.MemorySwappiness         #Def: from host, usually 60
                                  #0: no swap, i.e. bad latency (cannot read any cache), but better throughput (no writing caching)
                                  #100: always swap, i.e. inverse

SYSINFO."Total Memory"
NODEINFO.Description.Resources.
 MemoryBytes
TASKTMPINFO.Resources.Limits.
 MemoryBytes                      #Available on the host.

                                  ┌────────────────┐
                                  │   LIMITS CPU   │
                                  └────────────────┘

docker create|update|build ...
-c NUM                            #CPU shares:
--cpu-shares=NUM                  #  - relative weight between containers
CPSCONF.cpu_shares                #     - e.g. containers with twice more than other containers get twice more CPU
HOSTCONF.CpuShares                #     - distributed among running containers, i.e. idle containers are ignored
                                  #  - def: 1024. Min: 2.
--cpu-period=NUM
HOSTCONF.CpuPeriod                #Similar to CPU shared but from an OS process scheduler perspective:
--cpu-quota=NUM                   #  - --cpu-period is scheduler frequency (in ns, def: 100000)
CPSCONF.cpu_quota                 #  - max host's CPU is --cpu-quota / --cpu-period (def: same as 1 / number of containers)
HOSTCONF.CpuQuota                 #Wheras --cpu-shares distribute CPU between containers, --cpu-period|quota limits host's CPU to each container
docker service create ...
--limit-CPU NUM
NODEINFO.Description.Resources.
 NanoCPUs
TASKTMPINFO.Resources.Limits.
 NanoCPUs                         #NUM * 1e9 of CPU shares

--reserve-CPU NUM
TASKTMPINFO.Resources.Reservation.
 NanoCPUs                         #Like --memory-reservation, but for CPU

docker create|update|build ...
HOSTCONF.CpuCount|Percent         #Calculated from HOSTCONF.Cpu*. Windows only.

--cpuset-cpus=RANGE
CPSCONF.cpuset
HOSTCONF.CpusetCpus               #Only allow specific CPUs, as RANGE of index, e.g. 0-3 or 0,2
--cpuset-mems=RANGE
HOSTCONF.CpusetMems               #Same for memory nodes (MEMs), which is only used on NUMA systems
SYSINFO.CPUs                      #Available on the host. NUM

                                  ┌────────────────┐
                                  │   LIMITS I/O   │
                                  └────────────────┘

docker create|update ...
--blkio-weight=10-1000            #Block IO weight:
HOSTCONF.BlkioWeight              #  - relative weight between containers, i.e. like --cpu-shares but for I/O
                                  #  - only for direct block IO (not buffered block IO)
                                  #Def: 500
docker create ...
--blkio-weight-device=
 DEVICE_PATH:10-1000
HOSTCONF.BlkioWeightDevice        #Same but for a specific device, e.g. /dev/sda

--device-read|write-bps=
 DEVICE_PATH:NUM[kb|mb|gb]
HOSTCONF.BlkioRead|WriteBps       #Limit read|write rate from a device, as byte/sec
--device-read|write-iops=
 DEVICE_PATH:NUM
HOSTCONF.BlkioRead|WriteIops      #Same but as operation/sec

--io-maxbandwidth NUM
HOSTCONF.IoMaximumBandwidth
--io-maxiops NUM
HOSTCONF.IoMaximumIops            #System partition IO limits (Windows only)
HOSTCONF.DiskQuota                #

                                  ┌──────────────────────┐
                                  │   LIMITS PROCESSES   │
                                  └──────────────────────┘

docker create ...
--pids-limit NUM                  #Max number of processes (e.g. prevent fork bombs)
HOSTCONF.PidsLimit                #ulimit -u is per user (across containers), which this is per container

                                  ┌────────────────┐
                                  │   LIMITS IPC   │
                                  └────────────────┘

docker create|build ...
--shm-size=NUM[b|k|m|g]
CPSCONF.shm_size                  #Size of /dev/shm (device that can be mounted as tmpfs, i.e. like /tmp but for IPC)
HOSTCONF.ShmSize                  #Def: 64MB

                                  ┌──────────────┐
                                  │   METADATA   │
                                  └──────────────┘

LABEL ==>                         #Metadata on images, containers, daemons, volumes, networks, swarm nodes or swarm services
                                  #Can be:
                                  #  - viewed with docker inspect
                                  #  - used as filters with docker images, ps, network ls, events, node ls, service ls, service ps
                                  #Often used:
                                  #  - Name 'PROJECT'
                                  #  - Version|Release 'NUM'
                                  #  - Architecture 'x86|x86_64|i386'
                                  #  - Vendor STR
                                  #  - Url URI: project's website
                                  #  - Help URI


LABEL VAR="VAL" ...               #Dockerfile instruction
                                  #Sets labels (metadata). Can override.
                                  #It is recommended to do one pair per line (using trailing newlines)
docker create ...
-l VAR="VAL"
--label VAR[=VAL]
CPSCONF.labels.VAR                #Sets labels
--label-file FILE                 #Same from newline-delimited file, which can include # COMMENTS

docker volume|network|service
 create, dockerd, docker build ...
--label VAR[=VAL]                 #Sets labels
SYSINFO.Labels                    #Of dockerd
VOLUMEINFO|NETWORKINFO.Labels     #

docker service create ...
--container-label VAR[=VAL]       #On the containers created by SERVICE
--mount volume-label=VAR=VAL      #On volumes created by SERVICE

docker node|service update ...
--label-add VAR[=VAL]             #Sets labels
--label-rm VAR                    #Unsets labels

IMAGEINFO.Config.Labels.VAR
CONTAINERSPEC.Labels.VAR          #VAL


MAINTAINER AUTHOR                 #Dockerfile instruction. Metadata about author
docker commit ...
-a AUTHOR
--author AUTHOR
IMAGEINFO.Author                  #
DL4000                           ##Should be used
DL3012                           ##Should be NAME <EMAIL>

docker commit|import ...
-m COMMIT_MESSAGE
--message COMMIT_MESSAGE
IMAGEINFO.Comment                 #

                                  ┌───────────────────┐
                                  │   GENERAL DEBUG   │
                                  └───────────────────┘

dockerd|docker ...
-D
--debug
SYSINFO."Debug mode client|server"#
-l STR
--log-level=STR                   #

docker-compose ...
--verbose                         #

SIGUSR1                           #When sent to server, current stack traces will be logged


docker info                       #Prints SYSINFO
SYSINFO                           #System info. Attributes are documented in this doc

ENVAR DOCKER_NOWARN_KERNEL_VERSION#To remove warning when Linux kernel version is not compatible

                                  ┌─────────────┐
                                  │   LOGGING   │
                                  └─────────────┘

DAEMON'S LOGGING ==>              #No logging.
                                  #But if started by an init system, this init system will probablwill probably include logging


LOGDRIVER                         #Logging driver for container's stdout|stderr.
                                  #Can be:
                                  #  - none: no logging
                                  #  - json-file (def): JSON appended to file
                                  #  - syslog
                                  #  - journald
                                  #  - awslogs:
                                  #     - AWS Cloudwatch, using CreateLogStream() and PutLogEvents()
                                  #     - must provide AWS credentials to dockerd using ENVVAR
                                  #  - gcplogs (Google cloud)
                                  #  - splunk
                                  #  - etwlogs (Windows)
                                  #  - gelf (Graylog, logstash)
                                  #  - fluentd
                                  #LOGDRIVER options:
                                  #  - json-file, syslog, others:
                                  #     - labels VAR,...
                                  #        - if a container has LABEL VAR, adds it (and its value) to every log
                                  #     - env VAR,...
                                  #        - same for ENVVAR
                                  #     - tag GOTMP:
                                  #        - how CONTAINER_ID is printed (def: first 12 chars)
                                  #        - with OBJ: ID (first 12 chars), FullID, Name, Image[Full]ID|Name, DaemonName
                                  #  - json-file:
                                  #     - max-size NUM[k|m|g]: log rotation
                                  #     - max-file NUM: log rotation
                                  #  - awslogs:
                                  #     - awslogs-region REGION
                                  #     - awslogs-group STR
                                  #     - awslogs-stream STR
                                  #  - others: see online doc

docker create ...                 #
dockerd ...                       #
--log-driver LOGDRIVER
CPSCONF.logging.driver
HOSTCONF.LogConfig.Type
TASKTMPINFO.LogDriver.Name        #Sets LOGDRIVER
--log-opt VAR=VAL
CPSCONF.logging.options
HOSTCONF.LogConfig.Config         #LOGDRIVER options
TASKTMPINFO.LogDriver.Options     #Can be done several times
SYSINFO."Logging Driver"          #Current LOGDRIVER and its options

CONTAINERINFO.LogPath             #Cannot be configured.
                                  #E.g. can be DOCKERDIR/containers/CONTAINER_ID/CONTAINER_ID-json.log with LOGDRIVER "json-file"

dockerd ...
--raw-logs                        #Do not use colors


docker logs CONTAINER             #Prints logs of a container (i.e. stdout/stderr)
docker-compose logs [IMAGE_NAM...]#Only available for LOGDRIVER json-file and journald
                                  #Can differentiate stdout|stderr with REST API only
-t
--timestamps                     |#Print timestamps too
--details                         #Verbose

--tail NUM                       |#Only last NUM lines
--since DATE[TIME]                #
-f
--follow                         |#Pipe input, i.e. does not end


docker-compose logs|up ...
--no-color                       !#


LOGSPOUT ==>                     ##Redirects "docker logs ALL_CONTAINER"
                                 ##Is a Docker image
                                 ##Must have access to dockerd socket at /var/run/docker.sock
                                 ##Version 3.1
CMD PROTO:HOST[?VAR=VAL],...     ##PROTO can be: syslog, tls, tcp, udp, raw
                                 ##VAR:
                                 ##  - filter.name|id CONTAINER_NAME|ID:
                                 ##     - only include those containers
                                 ##     - can contain globbing
                                 ##  - filter.sources STREAM,...:
                                 ##     - STREAM is stdout|stderr
                                 ##     - must encodeURI ","
                                 ##  - colors 'off'
ENVVAR LOGSPOUT=ignore           ##Will not redirect logs of container setting this
ENVVAR EXCLUDE_LABEL=ENVVAR2     ##Will not redirect logs of container settings ENVVAR2
ENVVAR INACTIVITY_TIMEOUT=DUR    ##Of dockerd, before restarting
REST API ==>                     ##REST API:
                                 ##  - running at localhost:80 inside its container
                                 ##     - can expose it, e.g. --publish=IP:HOST_PORT:80
                                 ##  - GET /logs
                                 ##  - GET /logs/id:CONTAINER_ID
                                 ##  - GET /logs/name:CONTAINER_NAME
                                 ##  - /routes: advance or multiple redirections. See online doc
                                 ##  - Can use Accept: application/json [C], output is JSON
                                 ##  - Can use same ?VAR=VAL as below
PLUGINS ==>                      ##There are plugins for Redis, Logstash, Kafka, Loggly

                                  ┌────────────┐
                                  │   EVENTS   │
                                  └────────────┘

docker events                     #Prints stream of realtime events coming from server:
docker-compose events [IMG_NAM...]#  - as TIMESTAMP TYPE EVENT ID (ARGS)
                                  #Available TYPE + EVENT:
                                  #  - container
                                  #     - create|destroy, exec_create|detach|start, commit, update, rename, export
                                  #     - start, restart, stop, pause, unpause
                                  #     - health_status, oom, kill, die
                                  #     - attach|detach
                                  #     - copy
                                  #     - resize, top
                                  #  - image: delete, pull|push, tag|untag, import|load|save,
                                  #  - volume: create|destroy, mount|unmount
                                  #  - network: create|destroy, connect|disconnect
                                  #  - daemon: reload
                                  #  - plugin: install|remove, enable|disable
--since|until DATE                #If does not include current moment, is one-time (as opposed to realtime)
                                  #DATE can be:
                                  #  - NUM (Epoch in secs)
                                  #  - 'YYYY-MM-DD[THH:MM:SS[TZ]]'
                                  #  - DUR
--filter VAR=VAL                  #VAR:
                                  #  - type TYPE
                                  #  - event EVENT
                                  #  - image|container|volume|network|daemon|plugin IMAGE|CONTAINER|VOLUME|NETWORK|DAEMON|PLUGIN
                                  #  - label VAR[=VAL]
                                  #Can be done several times: or'd if same VAR, and'd otherwise
--json                           !#Outputs as JSON

                                  ┌────────────────┐
                                  │   MONITORING   │
                                  └────────────────┘

docker top CONTAINER [...]        #Prints running processes of a container: UID, PID, parent PID, time, command, TTY, etc.
                                  #... are passed to "ps" CLI command
                                  #Is run from host's perspective (e.e. PID)


docker stats CONTAINER...         #Prints realtime runtime metrics of containers: CPU, Memory, I/O, Network
                                  #Can get a lot more stats when using REST API
-a
--all                             #Also show non-running containers
--no-stream                       #Not realtime, i.e. only prints then exits

                                  ┌──────────────┐
                                  │   REGISTRY   │
                                  └──────────────┘

GOAL ==>                          #Repository (similar to GitHub) of Docker images
                                  #Post-build images are stored, not Dockerfile, i.e. consumers can run it right away
                                  #Can create/edit via website.

docker login [HOST]               #Authenticate to Docker Hub from CLI
                                  #Used when trying to push to repo
                                  #Save credentials at DOCKERCONF.auths.URL.auth "HASH"
-p PASSWORD
--password PASSWORD
-u USER
--user USER                       #Def: use interactive prompt


docker logout [HOST]              #


docker push [HOST/]IMAGE
docker-compose push [IMAGE_NAM...]#Push IMAGE to associated repo. IMAGE must include "REPO_USER/"
--ignore-push-failures           !#


docker pull [HOST/]IMAGE
docker-compose pull [IMAGE_NAM...]#Pull IMAGE from associate repo. IMAGE must include "REPO_USER/"
-a
--all-tags                        #Pull all related tags as well
--ignore-pull-failures           !#

FROM IMAGE [as IMAGE_ALIAS]       #Dockerfile instruction. Pull another IMAGE, and use it as base
                                  #Must be first instruction. Mandatory.
                                  #Can be done several times ("multi-stage builds"):
                                  #  - the last one will be used as base image
                                  #  - i.e. other IMAGEs are used during builds, but not used in final image, which reduces size
                                  #IMAGE_ALIAS is the name IMAGE can be referenced to inside Dockerfile
                                  #Prefer Docker official images
                                  #"scratch" is special IMAGE, most minimal possible
CPSCONF.image                     #Equivalent with Compose, except CPSCONF.build must not exist
docker build ...
docker-compose build ...
--pull                           |#Never use cache


dockerd ...
--max-concurrent-downloads|uploads
 NUM                              #Max parallel HTTP requests with docker pull|push (def: unlim)


docker search STR                 #Searches DockerHub, and prints results: name, description, stars,
--limit NUM                       #Def: 25
--no-trunc                        #Do not truncate description
-f VAR=VAL                        #Possible VAR:
--filter VAR=VAL                  #  - stars NUM (i.e. >= NUM)
                                  #  - is-official BOOL
                                  #  - is-automated BOOL


DEFAULT REGISTRY ==>              #Is Docker Hub
                                  #Can customize with:
                                  #  - dockerd --registry-mirror HOST
                                  #  - specifying HOST in docker login, etc.
SYSINFO.Registry                  #
docker service create ...
docker deploy ...
--with-registry-auth              #Must be done for Swarm leader to send registry authentication to other nodes


dockerd ...
--insecure-registry HOST[:PORT]
SYSINFO."Insecure registries"     #Must be used when custom registry does not use TLS, or HOST/ca.crt not available

dockerd ...
--disable-legacy-registry         #Do not allow custom registries with old versions of registry protocol


DOCKER REGISTRY ==>               #Project to host and manage own registry, fairly simple to setup:
                                  #  - support most operations: push|pull, content trust, webhooks, tags, authentication
                                  #  - to document only if I need to use it

DOCKER TRUSTED REGISTRY ==>       #Like Docker Hub but for private repositories, on-premise
                                  #  - integrated with Universal Control Plane
                                  #  - not free, aimed at entreprise with user management and authentication features

DOCKER HUB ==>                    #Official registry
                                  #Features:
                                  #  - push|pull, content trust, tags, wehbooks, user management
                                  #  - CI:
                                  #     - automatic image building when GitHub repo's Dockerfile changes
                                  #     - can push different images according to conditions (e.g. tag, branch)
                                  #Has paid plans with:
                                  #  - private repos
                                  #  - more parallel builds
                                  #  - image security scanning
                                  #Badges:
                                  #  - https://img.shields.io/docker:
                                  #     - /build/USER/REPO.svg: build status
                                  #     - /automated/USER/REPO.svg: whether automated
                                  #     - /pulls/USER/REPO.svg: number of pulls
                                  #     - /stars/USER/REPO.svg: number of stars

QUAY.IO ==>                       #Competitor of Docker Hub
                                  #Differences:
                                  #  - supports rkt
                                  #  - twice more expensive for private repos
                                  #  - about same features, except also:
                                  #     - repos activity stats
                                  #     - more notifications features (including webhooks)
                                  #Prefer Docker Hub

DOCKER STORE ==>                  #Search website for Docker images
                                  #Enterprise-oriented: paid images, long desription/reviews, review process for publishers

                                  ┌───────────────────┐
                                  │   CONTENT TRUST   │
                                  └───────────────────┘

CONTENT TRUST ==>                 #Verifying Docker registry (like Docker Hub) images tags (i.e. their connection to hash content) with TLS signatures
                                  #("trusted images")
                                  #  - for docker push|pull and docker build|create
                                  #  - bypassed if IMAGE contains HASH
                                  #  - bypassed if no TAG (except for pull, which uses "latest" by default)
                                  #  - signing is automatically done by docker
                                  #     - creates keys in DOCKERHOME/trust/
                                  #     - passphrases can be provided in interactive shell or using ENVVAR DOCKER_CONTENT_TRUST_ROOT|REPOSITORY_PASSPHRASE
ENVVAR DOCKER_CONTENT_TRUST=1     #Must be enabled
docker push|pull|build|create
--disable-content-trust           #

ENVVAR DOCKER_CONTENT_TRUST_SERVER#To override URL

                                  ┌─────────────┐
                                  │   PLUGINS   │
                                  └─────────────┘

docker plugin ...                 #New system replacing DRIVERs (e.g. for volumes, networks, storage, logging), but still experimental

dockerd ...
--authorization-plugin            #

SYSINFO.Plugins.TYPE
NODINFO.Description.Engine.Plugins#General information

                                  ┌─────────┐
                                  │   GUI   │
                                  └─────────┘

UNIVERSAL CONTROL PLANE ==>       #Multi-host: uses swarm mode
                                  #Many features
                                  #Uses docker compose
                                  #Best GUI, but not free, aimed at entreprise with user management and authentication features

KITEMATIC ==>                     #Features:
                                  #  - basic images listing
                                  #  - container state, CRUD, few flags
                                  #  - volumes CRUD
                                  #  - logs
                                  #Good UI, and official Docker project.
                                  #Linux is supported (.deb packages in tags section of GitHub repo)
                                  #Is the preferred GUI for simplicity
                                  #Version 1.12

UI-FOR-DOCKER ==>                ##Features:
                                 ##  - images CRUD, history, many flags
                                 ##  - container state, CRUD, many flags
                                 ##  - networks CRUD
                                 ##  - volumes CRUD
                                 ##  - events, logs
                                 ##  - docker info
                                 ##Is a Docker image
                                 ##Is the preferred GUI for flexibility
                                 ##Version 0.11.0

SIMPLE DOCKER UI ==>             ##Features:
                                 ##  - images CRUD, many flags, diff, history
                                 ##  - containers state, listing, stats, top, terminal, many flags
                                 ##  - events
                                 ##Version 0.5.0
                                 ##Chrome app

SHIPYARD ==>                     ##Features:
                                 ##  - images CRUD, commit
                                 ##  - container state, CRUD, many flags
                                 ##  - events, logs, stats
                                 ##  - custom registries
                                 ##Multi-host: uses Docker swarm (not swarm mode)
                                 ##  - manages Docker swarm itself (which is problematic)
                                 ##  - nodes listing
                                 ##  - scale
                                 ##Version 3.1.0

DOCKER CLOUD ==>                  #Can be used as GUI, but meant for continuous deployment
                                  #See its doc