Docker Syntax Cli Images

docker-syntax-cli-images

Quick Reference

Image Lifecycle Commands

System Management Commands

Critical Warnings

NEVER run docker system prune -a --volumes on production systems without first running docker system df -- it removes ALL unused volumes including database data.

NEVER use docker build (legacy) for new projects -- ALWAYS use docker buildx build which is the default BuildKit-based builder since Docker Engine 23+.

NEVER push images without verifying the tag -- docker push myapp pushes ALL tags of that repository. ALWAYS specify the exact tag: docker push myapp:v1.

ALWAYS use --platform when building for a different architecture -- omitting it silently builds for the host platform, causing exec format error at runtime on the target.

ALWAYS run docker system df before any cleanup operation to understand what is consuming disk space.

---

Buildx Build Flag Reference

Core Build Flags

Output Flags

Output types: docker (local), registry (push), local (filesystem), tar, oci, image.

Multi-Platform Flags

ALWAYS use --push or -o (not --load) when building for multiple platforms -- --load only supports single-platform images.

Cache Flags

Cache types: registry, local, inline, gha (GitHub Actions), s3, azblob.

Security & Secrets Flags

Attestation Flags

---

Buildx Builder Management

# Create a new builder instance
docker buildx create --name mybuilder --use

# List all builders
docker buildx ls

# Inspect current builder
docker buildx inspect

# Switch to a builder
docker buildx use mybuilder

# Remove a builder
docker buildx rm mybuilder

ALWAYS create a dedicated builder for multi-platform builds -- the default builder does not support multi-platform output.

---

Image Filter Cheat Sheet

docker images --filter

Image Format Placeholders

# Compact image list
docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}"

# JSON output (one per line)
docker images --format json

# Only IDs for scripting
docker images -q

# Remove all dangling images
docker rmi $(docker images -q -f dangling=true)

---

Disk Cleanup Strategy

ALWAYS follow this order -- from safest to most aggressive:

1. Assess -- docker system df -v 2. Containers -- docker container prune -f 3. Dangling images -- docker image prune -f 4. All unused images -- docker image prune -a -f 5. Build cache -- docker builder prune -f 6. Volumes -- docker volume ls -f dangling=true then docker volume prune -f 7. Nuclear -- docker system prune -a --volumes -f

What Each Prune Removes

Prune Filter Flags

---

Decision Tree: Which Cleanup Command?

Need to free disk space?
├── Know what's using space? → docker system df -v
├── Just dangling/untagged images? → docker image prune -f
├── All unused images? → docker image prune -a -f
├── Stopped containers? → docker container prune -f
├── Build cache growing? → docker builder prune -f
├── Unused volumes? → docker volume prune -f (CHECK FIRST!)
└── Everything unused? → docker system prune -a --volumes -f (DANGEROUS on prod)

Need to transfer images offline?
├── Full image with layers + tags + history → docker save / docker load
├── Container filesystem snapshot (no metadata) → docker export / docker import
└── Multi-platform manifest → docker manifest create + push

Need multi-platform builds?
├── Single platform, local use → docker buildx build --platform linux/amd64 --load .
├── Multiple platforms, push to registry → docker buildx build --platform linux/amd64,linux/arm64 --push .
└── Need a builder first? → docker buildx create --name mp --use

---

System Information Commands

docker system df

docker system df              # Summary: images, containers, volumes, build cache
docker system df -v           # Verbose per-resource breakdown
docker system df --format "table {{.Type}}\t{{.TotalCount}}\t{{.Size}}\t{{.Reclaimable}}"

docker info

docker info                                    # Full system information
docker info --format '{{.ServerVersion}}'      # Server version only
docker info --format '{{.Driver}}'             # Storage driver
docker info --format '{{json .Plugins}}'       # Available plugins

docker version

docker version                                 # Client + server versions
docker version --format '{{.Server.Version}}'  # Server version only
docker version --format json                   # JSON output

docker context

docker context ls                                                    # List all contexts
docker context create remote --docker "host=ssh://user@remote-host"  # Create SSH context
docker context use remote                                            # Switch to context
docker context use default                                           # Switch back
docker context inspect remote                                        # Show details
docker context rm remote                                             # Remove context

---

Reference Links

• references/commands.md -- Complete image and system command reference with all flags
• references/examples.md -- Image management workflows and cleanup scripts
• references/anti-patterns.md -- Common image management mistakes and how to avoid them

Official Sources

• https://docs.docker.com/reference/cli/docker/image/
• https://docs.docker.com/reference/cli/docker/buildx/build/
• https://docs.docker.com/reference/cli/docker/image/ls/
• https://docs.docker.com/reference/cli/docker/system/
• https://docs.docker.com/reference/cli/docker/system/prune/
• https://docs.docker.com/reference/cli/docker/system/df/

Image Management Anti-Patterns

Common mistakes in Docker image management and how to avoid them.

Source: https://docs.docker.com/reference/cli/docker/image/ and https://docs.docker.com/build/building/best-practices/

---

Build Anti-Patterns

AP-01: Using Legacy docker build

# WRONG -- legacy pre-BuildKit builder
docker build -t myapp:v1 .

# CORRECT -- BuildKit-based builder (default since Engine 23+)
docker buildx build -t myapp:v1 .

Why: Legacy docker build lacks BuildKit features: build secrets, SSH forwarding, cache exports, multi-platform builds, and parallel stage execution. ALWAYS use docker buildx build.

AP-02: Building Without --platform for Cross-Architecture

# WRONG -- silently builds for host platform
docker buildx build -t myapp:v1 --push .
# Fails with "exec format error" when run on different architecture

# CORRECT -- explicitly specify target platform(s)
docker buildx build --platform linux/amd64,linux/arm64 -t myapp:v1 --push .

Why: Without --platform, Docker builds for the host architecture. The image works on the build machine but fails on any different architecture. ALWAYS specify --platform when the target environment differs from the build environment.

AP-03: Using --load with Multi-Platform Builds

# WRONG -- --load only supports single platform
docker buildx build --platform linux/amd64,linux/arm64 --load -t myapp:v1 .
# Error: docker exporter does not support exporting manifest lists

# CORRECT -- use --push for multi-platform
docker buildx build --platform linux/amd64,linux/arm64 --push -t myregistry.com/myapp:v1 .

# CORRECT -- use --load for single platform only
docker buildx build --platform linux/amd64 --load -t myapp:v1 .

Why: The local Docker image store does not support manifest lists. Multi-platform builds MUST be pushed to a registry or exported to a directory.

AP-04: Not Using Build Cache in CI/CD

# WRONG -- every CI build starts from scratch
docker buildx build -t myapp:v1 .

# CORRECT -- use GitHub Actions cache
docker buildx build \
  --cache-from type=gha \
  --cache-to type=gha,mode=max \
  -t myapp:v1 .

# CORRECT -- use registry cache
docker buildx build \
  --cache-from type=registry,ref=myregistry.com/myapp:cache \
  --cache-to type=registry,ref=myregistry.com/myapp:cache,mode=max \
  -t myapp:v1 .

Why: Without cache configuration, CI builds download and rebuild every layer every time. This wastes minutes per build. ALWAYS configure --cache-from and --cache-to in CI environments.

AP-05: Embedding Secrets in Build Arguments

# WRONG -- build args are visible in image history
docker buildx build --build-arg DB_PASSWORD=secret123 -t myapp:v1 .
# Anyone can see: docker history --no-trunc myapp:v1

# CORRECT -- use build secrets (never stored in layers)
docker buildx build --secret id=DB_PASSWORD -t myapp:v1 .

In Dockerfile:

# WRONG
ARG DB_PASSWORD
RUN echo $DB_PASSWORD > /tmp/setup && setup.sh

# CORRECT
RUN --mount=type=secret,id=DB_PASSWORD cat /run/secrets/DB_PASSWORD | setup.sh

Why: Build arguments are stored in image layer metadata and visible to anyone with docker history. Build secrets are mounted only during the RUN instruction and NEVER stored in any layer.

---

Registry Anti-Patterns

AP-06: Pushing Without Explicit Tag

# WRONG -- pushes ALL local tags for the repository
docker push myregistry.com/myapp

# CORRECT -- push specific tag only
docker push myregistry.com/myapp:v1.0

Why: Omitting the tag pushes every local tag of that repository. This can accidentally overwrite production tags or push development images.

AP-07: Using :latest in Production

# WRONG -- "latest" is mutable and non-deterministic
docker pull myapp:latest

# CORRECT -- pin to specific version
docker pull myapp:1.25.3

# BEST -- pin to digest for immutability
docker pull myapp@sha256:abc123def456...

Why: The latest tag is mutable. It changes every time a new image is pushed. Production deployments MUST use specific version tags or digests to ensure reproducibility.

AP-08: Not Tagging Before Push

# WRONG -- image not tagged for registry
docker buildx build -t myapp:v1 .
docker push myapp:v1
# Error: push refers to repository [docker.io/library/myapp]

# CORRECT -- tag with full registry path first
docker tag myapp:v1 myregistry.com/myapp:v1
docker push myregistry.com/myapp:v1

# BEST -- tag during build
docker buildx build -t myregistry.com/myapp:v1 .
docker push myregistry.com/myapp:v1

Why: Without a registry prefix, Docker defaults to Docker Hub's library/ namespace. ALWAYS include the full registry path in the tag.

---

Cleanup Anti-Patterns

AP-09: Blind Nuclear Cleanup on Production

# WRONG -- removes ALL unused volumes (database data!)
docker system prune -a --volumes -f

# CORRECT -- assess first, then clean selectively
docker system df -v
docker container prune -f
docker image prune -f
# Only prune volumes after verifying none contain data
docker volume ls -f dangling=true

Why: docker system prune -a --volumes removes all unused volumes, including database data volumes that are not currently mounted. ALWAYS run docker system df -v first and NEVER prune volumes blindly on production.

AP-10: Not Cleaning Build Cache

# WRONG -- only cleaning images and containers
docker container prune -f
docker image prune -a -f
# Build cache still consuming gigabytes

# CORRECT -- include build cache in cleanup
docker builder prune -f
# Or for all build cache:
docker builder prune -a -f

Why: Build cache can grow to tens of gigabytes and is NOT removed by docker image prune. ALWAYS include docker builder prune in cleanup routines.

AP-11: Removing Images by Short ID Without Verification

# WRONG -- short ID might match multiple images
docker rmi abc123

# CORRECT -- verify first, then remove by full tag
docker images --no-trunc | grep abc123
docker rmi myapp:old-version

Why: Short IDs can be ambiguous. ALWAYS verify which image you are removing by listing with --no-trunc or removing by tag name.

---

Image Listing Anti-Patterns

AP-12: Ignoring Dangling Images

# WRONG -- never checking for dangling images
docker images

# CORRECT -- regularly check and clean dangling images
docker images -f dangling=true
docker image prune -f

Why: Every rebuild creates dangling images (old layers without tags). These accumulate silently and waste disk space. ALWAYS check docker images -f dangling=true regularly.

AP-13: Parsing docker images Output with Text Tools

# WRONG -- fragile text parsing
docker images | grep "myapp" | awk '{print $3}' | xargs docker rmi

# CORRECT -- use --format and --filter
docker images --filter reference="myapp*" -q | xargs docker rmi

# BEST -- use built-in filter
docker images -f reference="myapp:v1*" --format "{{.ID}}" | xargs docker rmi

Why: Text parsing of docker output is fragile and breaks with format changes. ALWAYS use --filter and --format for programmatic access.

---

Transfer Anti-Patterns

AP-14: Using docker export Instead of docker save

# WRONG -- export loses layers, history, tags, and metadata
docker export mycontainer > backup.tar
docker import backup.tar myapp:restored
# Result: single-layer image, no CMD, no ENTRYPOINT, no history

# CORRECT -- save preserves everything
docker save -o backup.tar myapp:v1.0
docker load -i backup.tar
# Result: exact same image with all layers, tags, and metadata

Why: docker export exports a container's filesystem as a flat tarball -- it loses ALL image metadata including CMD, ENTRYPOINT, ENV, EXPOSE, and layer history. ALWAYS use docker save/docker load for image transfer.

AP-15: Transferring Uncompressed Image Archives

# WRONG -- uncompressed tar can be very large
docker save -o huge-image.tar myapp:v1.0
# Result: 2GB file to transfer

# CORRECT -- compress for transfer
docker save myapp:v1.0 | gzip > myapp-v1.tar.gz
# Result: 800MB file

# BEST -- use zstd for better compression ratio and speed
docker save myapp:v1.0 | zstd > myapp-v1.tar.zst

Why: Docker images are already layer-compressed internally but the tar archive itself is not compressed. Compressing the archive can reduce transfer size by 50-70%.

---

System Management Anti-Patterns

AP-16: Not Monitoring Disk Usage

# WRONG -- wait until "no space left on device" error
# Then panic-run: docker system prune -a --volumes -f

# CORRECT -- proactive monitoring
docker system df              # Quick overview
docker system df -v           # Detailed breakdown

# Set up alerts on reclaimable space percentage

Why: Docker resource consumption grows silently. By the time you get a disk space error, the system may be unresponsive. ALWAYS monitor docker system df regularly or via scheduled checks.

AP-17: Using docker context Without Verification

# WRONG -- switch context and immediately run destructive commands
docker context use production
docker system prune -a --volumes -f

# CORRECT -- always verify which context is active
docker context ls
docker info --format '{{.Name}}'
# Then proceed with caution

Why: Docker contexts switch the target daemon. Running cleanup or destructive commands on the wrong context can destroy production data. ALWAYS verify the active context before running any modifying command.

AP-18: Ignoring docker system events for Debugging

# WRONG -- guessing why containers fail
docker logs myapp  # Not enough info

# CORRECT -- use system events for full picture
docker events --filter container=myapp --since 10m
docker events --filter type=image --since 1h

Why: docker events provides daemon-level visibility into container lifecycle, image pulls, network changes, and volume operations. ALWAYS check events when debugging unexpected behavior.

---

Summary: Quick Rules

---

Official Sources

• https://docs.docker.com/reference/cli/docker/image/
• https://docs.docker.com/reference/cli/docker/buildx/build/
• https://docs.docker.com/build/building/best-practices/
• https://docs.docker.com/reference/cli/docker/system/

Image & System Command Reference

Complete flag reference for Docker image management and system commands.

Source: https://docs.docker.com/reference/cli/docker/image/ and https://docs.docker.com/reference/cli/docker/system/

---

docker buildx build

Syntax: docker buildx build [OPTIONS] PATH | URL | -

Default builder since Docker Engine 23+. ALWAYS use this instead of legacy docker build.

All Flags

Core Build Flags

Output Flags

Output type reference:

Multi-Platform Flags

Cache Flags

Cache type reference:

Security & Secrets Flags

Access in Dockerfile:

RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret
RUN --mount=type=ssh git clone git@github.com:org/repo.git

Progress & Metadata Flags

Attestation Flags

---

docker buildx Management

docker buildx create

docker buildx create --name mybuilder           # Create builder
docker buildx create --name mybuilder --use      # Create and switch to it
docker buildx create --driver docker-container   # Use docker-container driver
docker buildx create --platform linux/amd64,linux/arm64  # Set platforms

docker buildx ls

docker buildx ls                                 # List all builders with status

docker buildx use

docker buildx use mybuilder                      # Switch active builder
docker buildx use default                        # Switch back to default

docker buildx inspect

docker buildx inspect                            # Inspect current builder
docker buildx inspect mybuilder                  # Inspect specific builder
docker buildx inspect --bootstrap                # Start builder if stopped

docker buildx rm

docker buildx rm mybuilder                       # Remove builder

---

docker pull

Syntax: docker pull [OPTIONS] NAME[:TAG|@DIGEST]

docker pull nginx                      # Latest tag
docker pull nginx:1.25                 # Specific tag
docker pull nginx@sha256:abc123...     # Specific digest (immutable)
docker pull --platform linux/arm64 nginx  # Specific platform
docker pull --all-tags nginx           # All tags of repository

---

docker push

Syntax: docker push [OPTIONS] NAME[:TAG]

docker push myregistry.com/myapp:v1      # Push specific tag
docker push --all-tags myregistry.com/myapp  # Push all tags

ALWAYS tag with full registry path before pushing: docker tag myapp:v1 myregistry.com/myapp:v1

---

docker tag

Syntax: docker tag SOURCE_IMAGE[:TAG] TARGET_IMAGE[:TAG]

docker tag nginx:latest myregistry.com/nginx:v1
docker tag abc123 myregistry.com/myapp:latest
docker tag myapp:v1 myapp:latest

---

docker images / docker image ls

Syntax: docker images [OPTIONS] [REPOSITORY[:TAG]]

---

docker rmi

Syntax: docker rmi [OPTIONS] IMAGE [IMAGE...]

docker rmi nginx:old                   # Remove by tag
docker rmi -f abc123                   # Force remove by ID
docker rmi $(docker images -q -f dangling=true)  # Remove all dangling

---

docker image prune

Syntax: docker image prune [OPTIONS]

docker image prune                     # Dangling only
docker image prune -a                  # All unused
docker image prune -f --filter "until=24h"  # Older than 24h
docker image prune --filter "label!=keep"   # Without "keep" label

---

docker save

Syntax: docker save [OPTIONS] IMAGE [IMAGE...]

Exports full image with all layers, tags, and history. Use for offline transfer.

docker save -o backup.tar nginx:latest
docker save nginx:latest > backup.tar
docker save nginx:latest redis:latest > multi.tar   # Multiple images

---

docker load

Syntax: docker load [OPTIONS]

Imports image from tar archive created by docker save.

docker load -i backup.tar
docker load < backup.tar
docker load -q -i backup.tar

---

docker history

Syntax: docker image history [OPTIONS] IMAGE

Shows the layer history of an image.

docker history nginx
docker history --no-trunc nginx
docker history --format "{{.CreatedBy}}" nginx
docker history -q nginx

---

docker manifest

Multi-platform manifest list management.

docker manifest inspect

docker manifest inspect nginx:latest
docker manifest inspect --verbose nginx:latest

docker manifest create

docker manifest create myapp:latest myapp:amd64 myapp:arm64
docker manifest create --amend myapp:latest myapp:amd64  # Amend existing

docker manifest annotate

docker manifest annotate myapp:latest myapp:arm64 --os linux --arch arm64

docker manifest push

docker manifest push myapp:latest
docker manifest push --purge myapp:latest  # Remove local after push

---

docker system df

Syntax: docker system df [OPTIONS]

Output fields: TYPE, TOTAL, ACTIVE, SIZE, RECLAIMABLE.

Verbose mode adds per-image details: Repository, Tag, Image ID, Created, Size, Shared Size, Unique Size, Containers.

---

docker system prune

Syntax: docker system prune [OPTIONS]

---

docker info

Syntax: docker info [OPTIONS]

Shows: server version, storage driver, logging driver, cgroup driver, kernel version, OS, architecture, CPUs, memory, registry config, security options, runtime.

---

docker version

Syntax: docker version [OPTIONS]

Shows both client and server version details including API version, Go version, OS/Arch.

---

docker context

docker context create

docker context create myctx --docker "host=ssh://user@host"
docker context create myctx --docker "host=tcp://host:2376,ca=ca.pem,cert=cert.pem,key=key.pem"

docker context ls

docker context ls
docker context ls --format "{{.Name}}: {{.DockerEndpoint}}"

docker context use

docker context use myctx
docker context use default

docker context inspect

docker context inspect myctx
docker context inspect --format '{{.Endpoints.docker.Host}}' myctx

docker context rm

docker context rm myctx
docker context rm -f myctx   # Force

---

Official Sources

• https://docs.docker.com/reference/cli/docker/image/
• https://docs.docker.com/reference/cli/docker/image/ls/
• https://docs.docker.com/reference/cli/docker/buildx/build/
• https://docs.docker.com/reference/cli/docker/system/
• https://docs.docker.com/reference/cli/docker/system/df/
• https://docs.docker.com/reference/cli/docker/system/prune/

Image Management Workflows & Cleanup Scripts

Practical workflows for building, transferring, and cleaning up Docker images.

Source: https://docs.docker.com/reference/cli/docker/image/ and https://docs.docker.com/reference/cli/docker/system/

---

Build Workflows

Basic Build and Tag

# Build with tag
docker buildx build -t myapp:v1.0 .

# Build with multiple tags
docker buildx build -t myapp:v1.0 -t myapp:latest .

# Build from specific Dockerfile
docker buildx build -f Dockerfile.prod -t myapp:prod .

# Build specific stage from multi-stage Dockerfile
docker buildx build --target builder -t myapp:build-stage .

# Build with build arguments
docker buildx build --build-arg NODE_ENV=production --build-arg APP_VERSION=1.0 -t myapp:v1.0 .

Build with Full Output (Debugging)

# Plain text progress (shows all build output)
docker buildx build --progress=plain -t myapp:v1.0 .

# No cache (force full rebuild)
docker buildx build --no-cache --pull -t myapp:v1.0 .

# Write metadata to file for CI inspection
docker buildx build --metadata-file build-meta.json -t myapp:v1.0 .

Build with Secrets

# Secret from file (NEVER baked into image layers)
docker buildx build --secret id=npmrc,src=$HOME/.npmrc -t myapp:v1.0 .

# Secret from environment variable
DB_PASSWORD=secret123 docker buildx build --secret id=DB_PASSWORD -t myapp:v1.0 .

# SSH agent for private Git repos
docker buildx build --ssh default=$SSH_AUTH_SOCK -t myapp:v1.0 .

Build with Cache (CI/CD)

# GitHub Actions cache
docker buildx build \
  --cache-from type=gha \
  --cache-to type=gha,mode=max \
  -t myapp:v1.0 .

# Registry-based cache
docker buildx build \
  --cache-from type=registry,ref=myregistry.com/myapp:cache \
  --cache-to type=registry,ref=myregistry.com/myapp:cache,mode=max \
  -t myregistry.com/myapp:v1.0 \
  --push .

# Local directory cache
docker buildx build \
  --cache-from type=local,src=/tmp/docker-cache \
  --cache-to type=local,dest=/tmp/docker-cache \
  -t myapp:v1.0 .

---

Multi-Platform Build Workflows

Setup Multi-Platform Builder

# Create builder with docker-container driver (required for multi-platform)
docker buildx create --name multiplatform --driver docker-container --use

# Verify platforms supported
docker buildx inspect --bootstrap

Build for Multiple Platforms

# Build and push for amd64 + arm64
docker buildx build \
  --platform linux/amd64,linux/arm64 \
  -t myregistry.com/myapp:v1.0 \
  --push .

# Build and push for all common platforms
docker buildx build \
  --platform linux/amd64,linux/arm64,linux/arm/v7 \
  -t myregistry.com/myapp:v1.0 \
  --push .

# Build single platform for local testing
docker buildx build --platform linux/arm64 --load -t myapp:arm64-test .

Create Manifest List Manually

# Build per-platform images
docker buildx build --platform linux/amd64 --load -t myapp:amd64 .
docker buildx build --platform linux/arm64 --load -t myapp:arm64 .

# Tag and push each
docker tag myapp:amd64 myregistry.com/myapp:amd64
docker tag myapp:arm64 myregistry.com/myapp:arm64
docker push myregistry.com/myapp:amd64
docker push myregistry.com/myapp:arm64

# Create and push manifest list
docker manifest create myregistry.com/myapp:latest \
  myregistry.com/myapp:amd64 \
  myregistry.com/myapp:arm64
docker manifest push myregistry.com/myapp:latest

---

Registry Workflows

Tag and Push

# Tag for registry
docker tag myapp:v1.0 myregistry.com/myapp:v1.0
docker tag myapp:v1.0 myregistry.com/myapp:latest

# Push specific tag
docker push myregistry.com/myapp:v1.0

# Push all tags at once
docker push --all-tags myregistry.com/myapp

Pull Strategies

# Pull by tag (mutable -- may change)
docker pull nginx:1.25

# Pull by digest (immutable -- ALWAYS gets exact same image)
docker pull nginx@sha256:abc123def456...

# Pull for specific platform
docker pull --platform linux/arm64 nginx:1.25

# Inspect remote manifest without pulling
docker manifest inspect nginx:latest

---

Offline Transfer Workflows

Transfer Image Between Hosts

# On source host: save image to tar
docker save -o myapp-v1.tar myapp:v1.0

# Transfer file (scp, usb, etc.)
scp myapp-v1.tar user@target-host:/tmp/

# On target host: load image from tar
docker load -i /tmp/myapp-v1.tar

# Verify
docker images myapp

Transfer Multiple Images

# Save multiple images into one archive
docker save -o all-images.tar nginx:1.25 redis:7 postgres:16

# Load all images at once
docker load -i all-images.tar

Compressed Transfer (Save Bandwidth)

# Save with compression
docker save myapp:v1.0 | gzip > myapp-v1.tar.gz

# Load from compressed archive
gunzip -c myapp-v1.tar.gz | docker load

# Or using zstd for better compression
docker save myapp:v1.0 | zstd > myapp-v1.tar.zst
zstd -d myapp-v1.tar.zst --stdout | docker load

Export Build Output to Filesystem

# Export build result to local directory (no image created)
docker buildx build -o type=local,dest=./output .

# Export as tar to stdout
docker buildx build -o type=tar,dest=image.tar .

# Export as OCI layout
docker buildx build -o type=oci,dest=oci-image.tar .

---

Image Inspection Workflows

Analyze Image Layers

# View full layer history (see what each layer does)
docker history --no-trunc myapp:v1.0

# Layer sizes only
docker history --format "table {{.Size}}\t{{.CreatedBy}}" myapp:v1.0

# Layer IDs for debugging
docker history -q myapp:v1.0

Find Large Images

# Sort images by size (largest first)
docker images --format "{{.Size}}\t{{.Repository}}:{{.Tag}}" | sort -hr

# Show images with exact sizes
docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}"

Find Dangling Images

# List all dangling (untagged) images
docker images -f dangling=true

# Count dangling images
docker images -f dangling=true -q | wc -l

# Show reclaimable space
docker system df

---

Cleanup Scripts

Daily Cleanup Script

#!/bin/bash
# daily-cleanup.sh -- Safe daily Docker cleanup
# ALWAYS assess before cleaning

echo "=== Docker Disk Usage ==="
docker system df

echo ""
echo "=== Removing stopped containers ==="
docker container prune -f --filter "until=24h"

echo ""
echo "=== Removing dangling images ==="
docker image prune -f

echo ""
echo "=== Removing unused networks ==="
docker network prune -f --filter "until=24h"

echo ""
echo "=== Disk Usage After Cleanup ==="
docker system df

Aggressive Cleanup Script (Development Only)

#!/bin/bash
# dev-cleanup.sh -- Aggressive cleanup for development machines
# NEVER use on production systems with data volumes

echo "=== Before Cleanup ==="
docker system df

echo ""
echo "=== Full Cleanup ==="
docker container prune -f
docker image prune -a -f
docker network prune -f
docker builder prune -a -f

echo ""
echo "=== After Cleanup ==="
docker system df

Production-Safe Cleanup Script

#!/bin/bash
# prod-cleanup.sh -- Conservative cleanup for production
# NEVER removes volumes or actively-used images

echo "=== Docker Disk Usage ==="
docker system df -v

echo ""
echo "=== Removing stopped containers older than 7 days ==="
docker container prune -f --filter "until=168h"

echo ""
echo "=== Removing dangling images only ==="
docker image prune -f

echo ""
echo "=== Removing build cache older than 7 days ==="
docker builder prune -f --filter "until=168h"

echo ""
echo "=== Disk Usage After Cleanup ==="
docker system df

Scheduled Cleanup (Cron)

# Add to crontab: crontab -e

# Daily at 2 AM: remove containers older than 24h and dangling images
0 2 * * * docker container prune -f --filter "until=24h" && docker image prune -f

# Weekly on Sunday at 3 AM: more aggressive cleanup
0 3 * * 0 docker container prune -f && docker image prune -a -f --filter "until=168h" && docker builder prune -f --filter "until=168h"

---

CI/CD Image Workflows

Build, Test, Push Pipeline

#!/bin/bash
# ci-pipeline.sh -- Build, test, and push in CI
set -euo pipefail

IMAGE="myregistry.com/myapp"
TAG="${CI_COMMIT_SHA:-latest}"

# Build
docker buildx build \
  --cache-from type=gha \
  --cache-to type=gha,mode=max \
  --load \
  -t "${IMAGE}:${TAG}" .

# Test
docker run --rm "${IMAGE}:${TAG}" npm test

# Tag and push
docker tag "${IMAGE}:${TAG}" "${IMAGE}:latest"
docker push "${IMAGE}:${TAG}"
docker push "${IMAGE}:latest"

# Clean up CI runner
docker rmi "${IMAGE}:${TAG}" "${IMAGE}:latest" 2>/dev/null || true

Build with Provenance and SBOM

# Production build with supply chain attestations
docker buildx build \
  --provenance=mode=max \
  --sbom \
  --push \
  -t myregistry.com/myapp:v1.0 .

---

System Monitoring Workflow

Quick System Health Check

#!/bin/bash
# docker-health.sh -- Quick system overview

echo "=== Docker Version ==="
docker version --format '{{.Server.Version}}'

echo ""
echo "=== Storage Driver ==="
docker info --format '{{.Driver}}'

echo ""
echo "=== Disk Usage ==="
docker system df

echo ""
echo "=== Running Containers ==="
docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Status}}"

echo ""
echo "=== Image Count ==="
echo "Total: $(docker images -q | wc -l)"
echo "Dangling: $(docker images -q -f dangling=true | wc -l)"

---

Official Sources

• https://docs.docker.com/reference/cli/docker/image/
• https://docs.docker.com/reference/cli/docker/buildx/build/
• https://docs.docker.com/reference/cli/docker/system/
• https://docs.docker.com/reference/cli/docker/system/prune/