docker-management

name	docker-management
description	Manage Docker containers, images, volumes, networks, and Compose stacks - lifecycle ops, debugging, cleanup, and Dockerfile optimization.
version	1.0.0
author	hermes-CCC (ported from Hermes Agent by NousResearch)
license	MIT
metadata	{"hermes":{"tags":["Docker","DevOps","Containers","Infrastructure","Compose"],"related_skills":[]}}

Docker Management

Purpose

• Use this skill to run, inspect, debug, and clean up Docker workloads.
• Prefer it when the task involves containers, images, networks, volumes, or Compose stacks.
• This skill covers both day-to-day lifecycle operations and practical debugging patterns.

Core Mental Model

• Images are immutable build artifacts.
• Containers are running or stopped instances of images.
• Volumes persist data outside the container filesystem lifecycle.
• Networks define service-to-service connectivity.
• Compose describes multi-container applications declaratively.

Container Lifecycle

• Create and run a container.
• Start a stopped container.
• Stop a running container.
• Restart a container after config or dependency issues.
• Remove a container when it is no longer needed.

Common Lifecycle Commands

docker run -d --name myapp -p 8080:80 -v ./data:/data myimage
docker start myapp
docker stop myapp
docker restart myapp
docker rm myapp

• -d runs the container in detached mode.
• --name assigns a stable container name.
• -p 8080:80 maps host port 8080 to container port 80.
• -v ./data:/data mounts a host path into the container.

Run Command Pattern

docker run -d --name myapp -p 8080:80 -v ./data:/data myimage

Use this pattern when you need:

• background execution
• a predictable container name
• host-to-container port mapping
• local bind-mount persistence

Inspect Running Containers

docker ps
docker ps -a

• docker ps shows running containers only.
• docker ps -a shows all containers including exited ones.
• Exited containers often reveal crash-loop or entrypoint problems.

Exec Into a Container

docker exec -it myapp bash

• Use this when the container image includes bash.
• Fall back to sh for slimmer images:

docker exec -it myapp sh

Useful checks inside a container:

• verify file paths
• inspect environment variables
• test network reachability
• check permissions
• run the application command manually

View Logs

docker logs -f myapp

• Use -f to follow logs live.
• Add --tail 100 to reduce noise when the log is very large.
• Container logs are the fastest first stop for boot failures.

List Images, Volumes, and Networks

docker images
docker volume ls
docker network ls

• docker images helps identify build tags and old layers.
• docker volume ls helps track stateful storage.
• docker network ls is useful when debugging Compose service communication.

Build Images

docker build -t myapp:latest .

• Tag images explicitly.
• Rebuild after Dockerfile changes, dependency changes, or copy-step changes.
• Keep the build context small with a .dockerignore.

Dockerfile Baseline

FROM python:3.12-slim

WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY . .
CMD ["python", "app.py"]

• Copy dependency manifests before source code to improve layer caching.
• Use a narrow base image unless native toolchains are required.

Multi-Stage Dockerfile Pattern

FROM node:22 AS build
WORKDIR /src
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM nginx:alpine
COPY --from=build /src/dist /usr/share/nginx/html
HEALTHCHECK CMD wget -qO- http://localhost/ || exit 1

• Build dependencies stay in the builder stage.
• The final stage is smaller and carries less attack surface.
• Multi-stage builds are standard for frontend artifacts, Go binaries, and compiled assets.

Health Checks

• Define health checks in the Dockerfile when the service has a meaningful liveness probe.
• Health checks help Compose and orchestration layers reason about readiness.

Example:

HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD curl -fsS http://localhost:8080/health || exit 1

• Prefer an explicit application health endpoint.
• Avoid health checks that pass before dependencies are ready unless that is intentional.

Docker Compose Basics

docker compose up -d
docker compose logs
docker compose down

• docker compose up -d starts the stack in the background.
• docker compose logs shows service logs across the stack.
• docker compose down stops and removes the stack's containers and network.

Minimal Compose Example

services:
  app:
    build: .
    ports:
      - "8080:8080"
    environment:
      APP_ENV: development
    depends_on:
      - redis

  redis:
    image: redis:7-alpine

• Compose is the default choice for local multi-service development.
• Keep service names stable because they also become DNS names on the Compose network.

Inspect Container Metadata

docker inspect myapp | jq '.[0].NetworkSettings'

• Use docker inspect to view full JSON metadata.
• Pipe through jq to isolate fields that matter.
• Useful fields include mounts, networks, exposed ports, health status, and entrypoint configuration.

Resource Usage

docker stats

• This gives a live view of CPU, memory, network I/O, and block I/O.
• Use it to spot memory leaks, unexpected idle CPU, or runaway workers.

Copy Files In and Out

docker cp file.txt myapp:/app/
docker cp myapp:/app/output.log ./output.log

• docker cp is useful for hot inspection, artifact extraction, and ad hoc debugging.
• Prefer rebuilds for durable fixes, but docker cp can unblock investigation quickly.

Cleanup

docker system prune -af
docker volume prune

• docker system prune -af removes unused containers, networks, dangling images, and build cache aggressively.
• docker volume prune removes unused volumes.
• Be careful: pruning can destroy useful cached layers and orphaned but still valuable data.

Common Debugging Patterns

Override the Entrypoint

docker run --rm -it --entrypoint sh myimage

• Override the entrypoint when the default startup command exits too quickly.
• This lets you inspect the filesystem and run the target process manually.

Check Environment Variables

docker exec -it myapp env

• Verify that expected secrets, ports, and mode flags are actually present.
• Many container bugs reduce to missing or misspelled env vars.

Check the Effective Command

docker inspect myapp | jq '.[0].Config.Entrypoint, .[0].Config.Cmd'

• This helps distinguish build-time assumptions from runtime reality.
• It is especially useful when wrapper scripts are involved.

Verify Mounts

docker inspect myapp | jq '.[0].Mounts'

• Bind-mount mistakes are common in local development.
• Check source path, destination path, and access mode.

Test Networking

docker exec -it myapp sh -c "wget -qO- http://redis:6379 || true"

• Test container-to-container DNS and reachability from inside the network namespace.
• For HTTP services, use curl or wget.
• For TCP-only services, use the relevant client or a port probe.

Image Hygiene

• Pin important base images when reproducibility matters.
• Use slim runtime images where possible.
• Minimize package-manager caches and temporary files.
• Copy only what is needed.
• Keep secrets out of the image entirely.

Security and Reliability Notes

• Do not bake credentials into Dockerfiles.
• Avoid running as root when the workload does not require it.
• Use read-only filesystems or dropped capabilities where appropriate.
• Scan images regularly with vulnerability tools.

Operational Guidance

• Prefer Compose for local stacks rather than long hand-written docker run chains.
• Use docker logs -f first when a service does not start cleanly.
• Use docker inspect when port mappings or mounts behave unexpectedly.
• Use health checks for services that depend on internal readiness.
• Prune deliberately, not reflexively.

Summary

• Manage container lifecycle with run, start, stop, restart, and rm.
• Build images with docker build -t myapp:latest ..
• Debug with docker exec -it myapp bash, docker logs -f myapp, docker inspect, and docker stats.
• Operate stacks with docker compose up -d, docker compose logs, and docker compose down.
• Clean carefully with docker system prune -af and docker volume prune.
• Use multi-stage Dockerfiles and health checks to improve runtime quality and image hygiene.