47.11 Docker system, context and login commands: full reference

Example 1: Full version

Type this:

docker version

You will see:

Client: Docker Engine - Community
 Version:           27.3.1
Server: Docker Engine - Community
 Engine:
  Version:          27.3.1
 containerd:
  Version:          1.7.22

What it means: Client and server are both 27.3.1, and containerd is 1.7.22.

Example 2: Only the server version

Type this:

docker version --format '{{.Server.Version}}'

You will see:

27.3.1

What it means: --format picks one field. Handy inside scripts.

Example 3: When the daemon is down

Type this:

sudo systemctl stop docker
docker version

You will see:

Client: Docker Engine - Community
 Version:  27.3.1
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

What it means: The client still answers, but the server part fails. Start it again with sudo systemctl start docker.

Example 4: The summary

Type this:

docker info

You will see:

Containers: 5
 Running: 2
 Paused: 0
 Stopped: 3
Images: 14
Storage Driver: overlay2
Logging Driver: json-file
CPUs: 2
Total Memory: 3.8GiB
Docker Root Dir: /var/lib/docker

What it means: Five containers, two of them running, fourteen images, and all data under /var/lib/docker.

Example 5: One field

Type this:

docker info --format '{{.Driver}}'

You will see:

overlay2

What it means: overlay2 is the normal storage driver on Linux.

Example 6: Look for warnings

Type this:

docker info 2>&1 | grep -i warning

You will see:

WARNING: No swap limit support

What it means: Warnings appear at the end. This one is common on Ubuntu and is usually safe to ignore.

Example 7: The short table

Type this:

docker system df

You will see:

TYPE            TOTAL     ACTIVE    SIZE      RECLAIMABLE
Images          14        2         6.1GB     5.2GB (85%)
Containers      5         2         120MB     80MB (66%)
Local Volumes   4         1         2.3GB     1.9GB (82%)
Build Cache     61        0         3.4GB     3.4GB

What it means: Images and build cache are the big ones. 5.2 GB of images are not used by any container.

Example 8: The detailed view

Type this:

docker system df -v | head -8

You will see:

Images space usage:

REPOSITORY   TAG     IMAGE ID       CREATED       SIZE     SHARED SIZE   UNIQUE SIZE   CONTAINERS
node         20      1d2f3c4b5a6e   3 weeks ago   1.1GB    0B            1.1GB         0
nginx        1.27    39286ab8a5e1   2 weeks ago   192MB    0B            192MB         1

What it means: -v means verbose. Now you see which image is heavy and how many containers use it.

Example 9: Compare with the real disk

Type this:

df -h /var/lib/docker | tail -1

You will see:

/dev/root  30G  24G  6.0G  80% /

What it means: The host disk is 80% full, and Docker owns most of it.

Example 10: Watch live

Type this:

docker events
# in a second terminal:
docker run --rm alpine echo hi

You will see:

2026-10-25T10:15:01 container create 7a1b... (image=alpine, name=calm_bose)
2026-10-25T10:15:01 container start 7a1b... (image=alpine, name=calm_bose)
2026-10-25T10:15:02 container die 7a1b... (exitCode=0, image=alpine)
2026-10-25T10:15:02 container destroy 7a1b...

What it means: One small run gives four events: create, start, die and destroy.

Example 11: Only die events

Type this:

docker events --filter event=die --since 1h

You will see:

2026-10-25T09:40:12 container die 4c9d... (exitCode=137, name=api)

What it means: Exit code 137 means the container was killed, often because it ran out of memory.

Example 12: Events for one container

Type this:

docker events --filter container=api --since 30m --until 0m

You will see:

2026-10-25T10:02:00 container start 4c9d... (name=api)
2026-10-25T10:05:31 container die 4c9d... (exitCode=1, name=api)

What it means: --since and --until give a time window, so the command ends by itself.

Example 13: The basic clean

Type this:

docker system prune

You will see:

WARNING! This will remove:
  - all stopped containers
  - all networks not used by at least one container
  - all dangling images
  - unused build cache
Are you sure you want to continue? [y/N] y
Total reclaimed space: 3.6GB

What it means: Typing y confirms. 3.6 GB came back.

Example 14: Also remove unused images

Type this:

docker system prune -a -f

You will see:

Deleted Images:
untagged: node:20
...
Total reclaimed space: 5.1GB

What it means: -a removes every image not used by a container, not only dangling ones. -f skips the question. Use it on build agents, not on servers where you need images ready.

Example 15: Keep recent things

Type this:

docker system prune -a -f --filter until=72h

You will see:

Total reclaimed space: 2.2GB

What it means: Only things older than 72 hours go. Recent builds keep their cache.

Example 16: Only build cache

Type this:

docker builder prune -f

You will see:

Total:  3.4GB

What it means: Build cache is safe to delete. The next build is just slower once.

Example 17: Only stopped containers

Type this:

docker container prune -f

You will see:

Deleted Containers:
9e1f...
b72a...
Total reclaimed space: 80MB

What it means: Running containers are never touched.

Example 18: See volumes before you prune

Type this:

docker volume ls -f dangling=true

You will see:

DRIVER    VOLUME NAME
local     pgdata_old
local     8f3c1e...

What it means: Dangling means no container uses it. Check the names before you run docker volume prune. A lost database volume cannot be brought back.

Example 19: Log in safely

Type this:

printf '%s' "$DOCKERHUB_TOKEN" | docker login -u ravibagale --password-stdin

You will see:

Login Succeeded

What it means: --password-stdin reads the token from input, so it never appears in your shell history.

Example 20: The unsafe way, for comparison

Type this:

docker login -u ravibagale -p mytoken

You will see:

WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Login Succeeded

What it means: It works, but the token is now in history and visible to other users in the process list. Do not do this.

Example 21: Push after login

Type this:

docker tag myapp:1.0 ravibagale/myapp:1.0
docker push ravibagale/myapp:1.0

You will see:

The push refers to repository [docker.io/ravibagale/myapp]
1.0: digest: sha256:7c1e... size: 1784

What it means: The push works because you are logged in.

Example 22: Get a token and log in

Type this:

aws ecr get-login-password --region ap-south-1 | docker login --username AWS --password-stdin 111122223333.dkr.ecr.ap-south-1.amazonaws.com

You will see:

Login Succeeded

What it means: The username is always the word AWS. The server is your account's ECR address. 111122223333 is a sample account number.

Example 23: Pull from ECR

Type this:

docker pull 111122223333.dkr.ecr.ap-south-1.amazonaws.com/shop-api:2.4

You will see:

2.4: Pulling from shop-api
Digest: sha256:91ab...
Status: Downloaded newer image

What it means: Pull works for 12 hours.

Example 24: After 12 hours

Type this:

docker pull 111122223333.dkr.ecr.ap-south-1.amazonaws.com/shop-api:2.4

You will see:

Error response from daemon: pull access denied ... authorization token has expired

What it means: Run the login line again. In Jenkins, put it at the start of every job.

Example 25: Look at the file

Type this:

cat ~/.docker/config.json

You will see:

{
  "auths": {
    "https://index.docker.io/v1/": {
      "auth": "cmF2aWJh..."
    }
  }
}

What it means: The auth value can be decoded by anyone who can read the file. Keep this file private, mode 0600.

Example 26: Set a safe file mode

Type this:

chmod 0600 ~/.docker/config.json
ls -l ~/.docker/config.json

You will see:

-rw------- 1 ravi ravi 142 Oct 25 10:20 /home/ravi/.docker/config.json

What it means: Only you can read it now.

Example 27: Use a credential helper

Type this:

sudo apt-get install -y pass golang-docker-credential-helpers
printf '{\n  "credsStore": "pass"\n}\n' > ~/.docker/config.json
printf '%s' "$DOCKERHUB_TOKEN" | docker login -u ravibagale --password-stdin

You will see:

Login Succeeded

What it means: Now config.json only says credsStore: pass. The token sits in the encrypted pass store. On Mac, Docker Desktop uses osxkeychain.

Example 28: Log out of Docker Hub

Type this:

docker logout

You will see:

Removing login credentials for https://index.docker.io/v1/

What it means: Docker Hub is the default.

Example 29: Log out of ECR

Type this:

docker logout 111122223333.dkr.ecr.ap-south-1.amazonaws.com

You will see:

Removing login credentials for 111122223333.dkr.ecr.ap-south-1.amazonaws.com

What it means: Name the registry for others.

Example 30: Check nothing is left

Type this:

cat ~/.docker/config.json

You will see:

{
  "auths": {}
}

What it means: The auths list is empty.

Example 31: List contexts

Type this:

docker context ls

You will see:

NAME        DESCRIPTION                 DOCKER ENDPOINT
default *   Current DOCKER_HOST based   unix:///var/run/docker.sock

What it means: Only the local one so far. The star says it is active.

Example 32: Show the current one

Type this:

docker context show

You will see:

default

What it means: A one-word answer, useful in your shell prompt.

Example 33: Inspect it

Type this:

docker context inspect default --format '{{.Endpoints.docker.Host}}'

You will see:

unix:///var/run/docker.sock

What it means: The address behind the name.

Example 34: Create a context over SSH

Type this:

docker context create staging --docker host=ssh://ubuntu@10.0.1.25

You will see:

staging
Successfully created context "staging"

What it means: It uses your normal SSH key. Nothing is installed on the server.

Example 35: Use it

Type this:

docker context use staging
docker ps --format '{{.Names}}'

You will see:

staging
shop-web
shop-api

What it means: These containers are on the staging server, not your laptop.

Example 36: Run one command only, then remove

Type this:

docker --context default ps -q | wc -l
docker context use default
docker context rm staging

You will see:

3
default
staging

What it means: --context changes the target for one command only. rm removes only the saved name; the server is untouched.