Docker Deep Dive · Reference

Linux & Shell Cheatsheet

Everything phase 0 (P1–P7) teaches, in the shape you'll reach for it. The Docker CLI gets its own cheatsheet as those lessons arrive; this page is the Linux underneath every Docker command.

docker run -it --rm ubuntu:24.04 bash

Move around, look around · P1

command -f --long-flag argument1 argument2

/etc/nginx/nginx.conf   # absolute: starts at the root /
../logs/app.log         # relative: from where you are (.. = up one)
~/projects              # ~ = your home directory

ls --help        # quick flags list — works in containers
man ls           # full manual — on your Mac (container images strip docs)
type ls          # what IS this command — binary, builtin, or alias?

Files, permissions, root · P2

-  rwx  r-x  r--   1  app  staff  4096  Jul 17  deploy.sh
│   │    │    │       └owner └group
│   │    │    └─ everyone else: read only
│   │    └────── group "staff": read + execute
│   └─────────── owner "app": read + write + execute
└─ type: - file · d directory · l symlink

chmod +x deploy.sh          # make executable
chmod 644 app.conf          # rw-r--r-- : owner edits, world reads
chmod 600 secret.env        # rw------- : owner only
chmod 755 bin/              # rwxr-xr-x : dirs need x to be entered
chown -R app:app /data      # give a tree to user:group (root only)
id                          # who am I — uid, gid, groups
su - dev                    # become user dev (fresh login shell)

Directory triads read differently: r = list names, w = create/delete entries, x = enter/traverse. Containers run as root by default — the whole point of lesson 11's USER.

Streams, pipes, text · P3

cmd > out.txt        # stdout → file (TRUNCATES first)
cmd >> out.txt       # append instead
cmd 2> err.txt       # stderr → file
cmd > all.txt 2>&1   # both → one file (order matters)
cmd 2> /dev/null     # discard complaints
cmd < input.txt      # stdin ← file

grep " 500 " access.log | cut -d' ' -f7 | sort | uniq -c | sort -rn | head -3
# filter → extract field → group (sort THEN uniq) → rank → top 3

docker rm $(docker ps -aq)   # $( ) = run inner command, paste its output here

Processes, environment, signals · P4

ps aux                  # every process: PID, CPU, MEM, command
ps -ef --forest         # parent→child tree (who started whom)
sleep 500 &             # & = run in background, prints its PID
jobs                    # this shell's background jobs
kill PID                # polite: SIGTERM — "please clean up and exit"
kill -9 PID             # brutal: SIGKILL — unignorable, no cleanup
echo $?                 # exit code of the last command

NAME=harbor             # shell variable — this shell only
export NAME=harbor      # environment variable — inherited by children
NAME=harbor cmd         # one-shot: set only for that command
echo "$NAME"            # read (quote it — always)
echo "${PORT:-8000}"    # read with default if unset (entrypoint gold)
env | sort              # everything this process will pass down
echo "$PATH"            # where the shell hunts for commands, left→right

Kernel, /proc, namespaces · P5

uname -r                     # kernel version — same in EVERY container on this machine
ls /proc                     # one numbered dir per process (ps just reads these)
cat /proc/1/cmdline          # what PID 1 really is
cat /proc/meminfo            # live kernel memory accounting
ls -l /proc/$$/ns            # the namespaces THIS shell lives in

strace -c ls                       # count every syscall ls makes
strace -e trace=openat cat /etc/hostname   # watch just the file-opens

unshare --pid --fork --mount-proc bash   # new PID namespace: ps shows you as PID 1

cat /sys/fs/cgroup/memory.max        # this group's memory ceiling (bytes or "max")
cat /sys/fs/cgroup/cgroup.procs      # PIDs governed by this group

Ports, DNS, packages · P6

ip addr                 # interfaces: lo (127.0.0.1) + eth0
ss -tlnp                # tcp listeners: port, PID — the "is it up?" command
curl -v localhost:8000  # speak HTTP, show the whole conversation
getent hosts db         # resolve a name the way the OS does
cat /etc/hosts          # local name overrides (checked first)
cat /etc/resolv.conf    # who answers DNS (in Docker nets: 127.0.0.11)

apt-get update                   # refresh the package index (a local cache!)
apt-get install -y curl          # install; -y for scripts/Dockerfiles
dpkg -L curl                     # what files did it put where (FHS in action)
rm -rf /var/lib/apt/lists/*      # drop the index cache — the lesson-8 slimming move

apk add --no-cache curl

Scripts & entrypoints · P7

#!/usr/bin/env bash
set -euo pipefail        # die on error, on unset vars, in broken pipes

name="${1:?usage: $0 NAME}"      # $1 = first argument, or die with usage
echo "deploying ${name} to ${ENV:-dev}"

#!/usr/bin/env bash
set -e
echo "preparing config from env…"       # setup work happens as a script
exec "$@"                               # then REPLACE the shell with the real app:
                                        # app becomes PID 1 → docker stop's SIGTERM reaches it

CMD ["python", "app.py"]     # exec form — python IS PID 1, signals arrive ✓
CMD python app.py            # shell form — sh -c wrapper eats SIGTERM ✗

Terms · phase 0 glossary