Docker Cheatsheet

Environment and Config

Use this Docker reference while you build software engineering projects, review code for technical interview prep, or polish examples for a software engineer resume.

Passing Environment Variables

# Single variable
docker run -e NODE_ENV=production myapp

# Multiple variables
docker run -e NODE_ENV=production -e PORT=3000 myapp

# From host environment (value inherited)
export DB_URL=postgres://...
docker run -e DB_URL myapp

# From a file
docker run --env-file .env myapp

.env File Format

# .env
NODE_ENV=production
PORT=3000
DATABASE_URL=postgres://user:pass@db:5432/mydb
API_KEY=supersecret

--env-file does NOT support shell expansions, comments with inline values, or multi-line values. Keep it simple: KEY=value one per line.

Compose Environment

services:
  web:
    environment:
      NODE_ENV: production
      PORT: "3000"
    # or list syntax:
    environment:
      - NODE_ENV=production
      - PORT=3000

    env_file:
      - .env
      - .env.local        # merged; later files win

    # Variable substitution from shell or .env
    image: myapp:${TAG:-latest}

Build-time vs Runtime Variables

Feature	Available at build	Available at runtime
`ARG`	Yes	No (unless also set as `ENV`)
`ENV`	Yes	Yes
`-e` / `--env-file`	No	Yes

ARG BUILD_DATE
ARG GIT_COMMIT
ENV GIT_COMMIT=${GIT_COMMIT}   # promote to runtime

docker build \
  --build-arg BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
  --build-arg GIT_COMMIT=$(git rev-parse --short HEAD) \
  -t myapp .

Docker Config Files

File	Purpose
`~/.docker/config.json`	Auth credentials, HTTP proxy, aliases
`/etc/docker/daemon.json`	Daemon config (storage driver, logging, registries…)
`~/.docker/contexts/`	Named engine contexts

daemon.json common options

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "insecure-registries": ["registry.internal:5000"],
  "registry-mirrors": ["https://mirror.example.com"],
  "storage-driver": "overlay2",
  "default-address-pools": [
    { "base": "172.17.0.0/12", "size": 24 }
  ],
  "live-restore": true
}

sudo systemctl reload docker   # apply daemon.json changes

Logging Drivers

# Set per container
docker run --log-driver json-file --log-opt max-size=10m myapp
docker run --log-driver syslog --log-opt syslog-address=udp://logs:514 myapp
docker run --log-driver none myapp     # suppress all logs

Driver	Use case
`json-file`	Default; `docker logs` works
`local`	Compressed json-file variant
`syslog`	Forward to syslog
`journald`	systemd journal
`gelf`	Graylog / Logstash
`fluentd`	Fluentd aggregator
`awslogs`	Amazon CloudWatch Logs
`none`	Discard all logs

Secrets Management Patterns

# Docker Swarm secrets
echo "s3cr3t" | docker secret create db_password -
docker service create \
  --secret db_password \
  --env DB_PASSWORD_FILE=/run/secrets/db_password \
  myapp

# Read secret in app code
password=$(cat /run/secrets/db_password)

# Compose with secret file
secrets:
  db_password:
    file: ./secrets/db_password.txt

services:
  app:
    secrets:
      - db_password
    environment:
      DB_PASSWORD_FILE: /run/secrets/db_password

Never store secrets in ENV instructions in Dockerfiles — they are visible in docker history and image metadata. Use runtime injection or secret mounts.

Resource Limits

docker run --cpus 1.5 --memory 512m --memory-swap 1g myapp
docker run --pids-limit 200 myapp

# Compose resource limits
services:
  web:
    deploy:
      resources:
        limits:
          cpus: "1.5"
          memory: 512M
        reservations:
          cpus: "0.5"
          memory: 128M