Skip to content
Search

Docker

lastmod 2026-11-03created 2015-01-15255 edits

Docker is an open-source project that automates the deployment of Linux applications inside software containers. Quoting the features from the Docker web page:

Docker containers wrap a piece of software in a complete file system that contains everything the software needs to run. This includes anything installed on a server, such as code, runtime, system tools, and system libraries. This guarantees that it will always run the same, regardless of the environment it is running in.

Docker additionally provides a layer of abstraction and automation of operating-system-level virtualization on Linux. Docker uses the resource isolation features of the Linux kernel, such as cgroups and kernel namespaces, and of union-capable file systems such as aufs, allowing independent "containers" to run within a single Linux instance and thereby avoiding the overhead of starting and maintaining virtual machines.

The Linux kernel's namespace support largely isolates an application's view of the operating environment, including process trees, network user IDs, and mounted file systems, while the kernel's cgroups provide resource limiting, including CPU, memory, block I/O, and network. Since version 0.9, Docker includes the libcontainer library as the sole means of directly using the virtualization facilities provided by the Linux kernel, in addition to using abstracted virtualization interfaces through libvirt, LXC (Linux Containers), and systemd-nspawn.

Cagegory

Ecosystem

A collection of related projects that make up the Docker ecosystem

PaaS

  • tsuru - Open source, extensible and Docker-based Platform as a Service (PaaS).

FaaS

  • OpenFaaS - Serverless Functions Made Simple

Volume

Automatic Updates

Compose

Swarm

Utilities

Build

Software router

AI

  • Cua - Open-source Docker container for AI agents

ETC

Managing Docker as a non-root user

Docker requires sudo by default. To use docker without sudo, you must add the user to the Docker Group.

Create the docker group: 

$ sudo groupadd docker

Add the user to the docker group. 

$ sudo usermod -aG docker $USER

Log out and log back in so that your group membership is re-evaluated.

WARNING

If you are running Linux in a virtual machine, you may need to restart the virtual machine for the changes to take effect.

Run the newgrp command to activate the changes to the group: 

$ newgrp docker

Resource limit

--cpu-share=1024 or -c 1024
The default is 1024, meaning a CPU allocation ratio of 1
Setting 2048 means twice as much time is allocated for CPU work as for a regular Container
--cpuset-cpus="0,3"
Use the 1st and 4th CPUs
--cpuset-cpus="0-2"
Use the 1st, 2nd, and 3rd CPUs
--cpus=0.2
Use 0.2 of a CPU (20%).

To adjust the resources of an already running container, use docker update. 

// cpu 1개만 사용하도록 변경
docker update --cpuset-cpus=1 [container_name] 

// cpu 사용량을 0.5 비율로 사용하도록 변경
docker update --cpu-shares 512 [container_name]

// cpu 사용량을 20% 비율로 사용하도록 변경
docker update --cpus=0.2 [container_name]

Test it with the stress command inside the container.

Resource prune

A collection of methods to use when running out of space.

Check Docker disk usage with the following command: 

docker system df

Don't know, just want to clean it all up in one shot: 

docker system prune -a

This command deletes the following.

  • Unused containers
  • Unused networks
  • Unused images (with the -a option, deletes all untagged images)
  • Unused build cache

A few examples: 

## 모든 중지된 컨테이너 삭제
docker container prune

## 모든 컨테이너 강제 삭제
docker rm -f $(docker ps -aq)

## 사용하지 않는 이미지 삭제
docker image prune -a

## 모든 이미지 삭제
docker rmi $(docker images -q)

## 사용하지 않는 볼륨 삭제
docker volume prune

## 모든 볼륨 삭제
docker volume rm $(docker volume ls -q)

## 사용하지 않는 네트워크 삭제
docker network prune

## 모든 네트워크 삭제
docker network rm $(docker network ls -q)

## 빌드 캐시 삭제
docker builder prune

Healthcheck

See Docker Compose#Healthcheck. Includes command usage examples.

Example

  • docker pull [IMAGE_NAME]: Download image.
  • docker images: List of image.
  • docker images --digests: List images along with their digests.
  • docker rmi [IMAGE_NAME|IMAGE_ID]: Remove an image.
  • docker rm [CONTAINER_ID]: Delete a container.
  • docker start [CONTAINER_ID]: Start a container.
  • docker attach [CONTAINER_ID]: Attach to a container.
  • docker ps -a: Check the status of all containers.
  • docker run -rm -i -t [IMAGE_NAME] [COMMAND]: Run an image. -rm removes the container after it exits, and -i means interactive mode is used.
  • docker run -d -p [HOST_PORT]:[GUEST_PORT] [IMAGE_NAME]: Run an image. -d runs the container in the background, and -p applies port forwarding.
  • docker system df -v: Check volume usage.
  • docker run -it --storage-opt size=120G fedora /bin/bash: Limit disk size at run time.

Swarm

docker container ls
List swarm containers.
docker container exec -it [IMAGE_NAME] bash
Run bash interactively in the specified swarm container.

Script

docker ps --all --format "{{.ID}}" | xargs docker rm -f
Force-remove all created containers.
docker images --all --format "{{.ID}}" | xargs docker rmi -f
Force-remove all created images.
docker run -d --restart=unless-stopped -p 80:8080 rancher/server
Connect Host(80) and Guest(8080)
Run the container in Detached mode (Background) (-d)
Always restart the container regardless of exit status. However, do not start it if the container has been stopped (--restart=unless-stopped)
docker run --rm -i -t ubuntu
--rm: Automatically remove the container after it exits.
-i: Use interactive mode.
-t: Allocate a virtual TTY.
docker run -d --restart unless-stopped redis
Start containers automatically | Docker Documentation
Always run unless the container is stopped.
docker tag local-image:tagname new-repo:tagname
Add a tag
docker push new-repo:tagname
Upload to DockerHub.
docker ps -a --format "table {{.ID}}\t{{.Names}}\t{{.Image}}\t{{.Status}}\t{{.CreatedAt}}" --filter name=ddrm
List containers whose names have the prefix ddrm.

VM vs Docker

Vm_vs_docker.jpg

Sharing files with host machine

Simply put, use a Volume. 

$ docker run -v /Users/bob/myapp/src:/src [...]

X11 on Docker (or RDP)

Manual connection method

First, on the host machine, set permissions so that all programs run by the user named docker can access the X Window: 

xhost +local:docker

Check the DISPLAY environment variable: 

echo $DISPLAY

Run Docker: 

docker run --rm -it -v /tmp/.X11-unix:/tmp/.X11-unix -e DISPLAY=$DISPLAY ubuntu

Then, in the guest (inside the container): 

apt update
apt install x11-apps
xeyes

## 또는 OpenGL 테스트를 하고싶다면:
apt update
apt install mesa-utils
glxgears

To restore the X Window access permissions: 

xhost -local:docker

Besides the docker user, you can also set X windows to the logged-in user as below. 

xhost +local:$USER

...

xhost -local:$USER

Firefox docker example 

FROM ubuntu:14.04

RUN apt-get update && apt-get install -y firefox

# Replace 1000 with your user / group id
RUN export uid=1000 gid=1000 && \
    mkdir -p /home/developer && \
    echo "developer:x:${uid}:${gid}:Developer,,,:/home/developer:/bin/bash" >> /etc/passwd && \
    echo "developer:x:${uid}:" >> /etc/group && \
    echo "developer ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/developer && \
    chmod 0440 /etc/sudoers.d/developer && \
    chown ${uid}:${gid} -R /home/developer

USER developer
ENV HOME /home/developer
CMD /usr/bin/firefox

Build: 

$ docker build -t firefox .

it and run the container with: 

docker run -ti --rm \
       -e DISPLAY=$DISPLAY \
       -v /tmp/.X11-unix:/tmp/.X11-unix \
       firefox

Docker with XQuartz 

IP_ADDRESS=$(ifconfig en0 | grep inet | awk '$1=="inet" {print $2}')
DISPLAY_INDEX=0

open -a XQuartz
xhost + $IP_ADDRESS

docker run --rm -it -e DISPLAY=$IP_ADDRESS:$DISPLAY_INDEX -v /tmp/.X11-unix:/tmp/.X11-unix  ...

Firefox in macOS

First run XQuartz. You can execute XQuartz app directly or type in the command below. 

open -a XQuartz

In XQuartz preference, go to "Security" and check "Allow connections from network clients"

Then go to terminal and run following commands. 

ip=$(ifconfig en0 | grep inet | awk '$1=="inet" {print $2}')  
xhost + $ip

Here you can run Firefox in a Docker container with Download folder mounted! 

docker run -d --name firefox -e DISPLAY=$ip:0 -v /tmp/.X11-unix:/tmp/.X11-unix -v $HOME/Downloads:/root/Downloads jess/firefox

Docker Firefox/Chromium web

A VNC server is opened, and you connect to it through a Web Browser. See Firefox#Docker container for Firefox. There is also Chromium#Docker container for Chromium.

Remove all script

Remove all process: 

$ docker ps --all | awk '{printf("%s\n", $1);}' | sed -n -e '2,$p' | xargs docker stop
$ docker ps --all | awk '{printf("%s\n", $1);}' | sed -n -e '2,$p' | xargs docker rm

Remove all images: 

$ docker images --all | awk '{printf("%s\n", $3);}' | sed -n -e '2,$p' | xargs docker rmi

Changing the assigned IP range

Modify the /etc/docker/daemon.json file as follows: 

{
  "bip": "172.20.0.1/16",
  "default-address-pools": [
    {"base": "172.21.0.1/16", "size": 24}
  ]
}
  • bip - bip is the range of the bridge network used by docker containers. (Bridge IP)
  • default-address-pools - IP range assigned to docker networks (also used when creating with compose) -> such networks get interface names like br-6d0b06b43ab1 on the host PC

WARNING

Conflicts happened often after setting up a VPN

Checking iptables changes

You can check all iptables rules with the following command. 

sudo iptables -L

The output looks like this: 

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy DROP)
target     prot opt source               destination
DOCKER-USER  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain DOCKER (3 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             172.19.0.2           tcp dpt:8889
ACCEPT     tcp  --  anywhere             172.19.0.3           tcp dpt:8889
ACCEPT     tcp  --  anywhere             172.19.0.2           tcp dpt:8888
ACCEPT     tcp  --  anywhere             172.19.0.3           tcp dpt:8888
ACCEPT     tcp  --  anywhere             172.19.0.2           tcp dpt:8554
ACCEPT     tcp  --  anywhere             172.19.0.3           tcp dpt:8554
ACCEPT     tcp  --  anywhere             172.19.0.4           tcp dpt:6379
ACCEPT     tcp  --  anywhere             172.19.0.2           tcp dpt:1935
ACCEPT     tcp  --  anywhere             172.19.0.3           tcp dpt:1935

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-ISOLATION-STAGE-2 (3 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

Chain DOCKER-USER (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Look especially at the "Chain DOCKER" section.

You can see the ports of running containers.

See iptables or Docker:Iptables for details.

Control Docker with systemd 

sudo systemctl enable docker.service
sudo systemctl enable containerd.service

To add it as a dependency in another systemd service file: 

[Unit]
After=docker.service

...

NTP (time synchronization)

Either mount volumes as follows: 

volumes:
    - "/etc/timezone:/etc/timezone:ro"
    - "/etc/localtime:/etc/localtime:ro"

or use the TZ environment variable.

Docker log file and options

The file path can be checked with the following command. 

docker inspect --format='{{.LogPath}}' [컨테이너ID]

Global docker settings

Edit the daemon.json file.

  • Linux /etc/docker
  • Windows C:\ProgramData\docker\config\ 
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3",
    "labels": "production_status",
    "env": "os,customer"
  }
}

Then restart the docker service.

Settings for a specific container only 

docker run --log-opt max-size=100m --log-opt max-file=5 my-app:latest

Change data directory

With a default installation, data is stored in /var/lib/docker. You can change the directory by editing the daemon configuration file (/etc/docker/daemon.json) as below. 

{
  "data-root": "/data/docker",
  "storage-driver": "overlay2"
}

Docker in Docker

See Docker-in-Docker for details.

Connecting to a Proxy server

Create the docker service daemon folder: 

sudo mkdir -p /etc/systemd/system/docker.service.d

Create the proxy server configuration file 

sudo vi /etc/systemd/system/docker.service.d/http-proxy.conf

Write the contents of the http-proxy.conf file: 

[Service]
Environment="HTTP_PROXY=http://proxy.example.com:80"
Environment="HTTPS_PROXY=https://proxy.example.com:443"
Environment="NO_PROXY=localhost,127.0.0.1"

Restart the docker daemon 

sudo systemctl daemon-reload
sudo systemctl restart docker

Check the result 

sudo systemctl show --property=Environment docker

Exit code

exit code 0: Exited successfully

The most common case: the init process inside the container has finished its job and exited normally, or the container was stopped by docker stop. Since the code is also 0 when terminated by SIGTERM, there seems to be little difference between the two.

exit code 125: The docker command itself failed

The run itself did not succeed because of an invalid docker command or flag. In practice, this error code is never seen in docker ps -a output. 

[root@docker-node01 ~] docker run --foo busybox; echo $?
 unknown flag: --foo
See 'docker run --help'.
125

exit code 126: The container's command failed

The command failed when the container was run. This covers cases such as a command that is meaningful in itself but cannot be executed. The container is created and in the Created state, but since it cannot run at all, this code is not shown in docker ps -a. 

[root@docker-node01 ~] docker run busybox /etc; echo $?
 docker: Error response from daemon: OCI runtime create failed: container_linux.go:348: starting container process caused "exec: \"/etc\": permission denied": unknown.
126

exit code 127: The container's command does not exist

The command configured for the container does not exist inside the container and cannot be executed. As with 126, the container is created but does not run. 

[root@docker-node01 ~] docker run busybox alicek106; echo $?
 docker: Error response from daemon: OCI runtime create failed: container_linux.go:348: starting container process caused "exec: \"alicek106\": executable file not found in $PATH": unknown.
127

exit code 128 + n: An error corresponding to Linux signal n occurred

Covers the cases below, except 255.

exit code 130: (128+2) Terminated with Control + C

An interrupt routine (Control + C) was delivered to the init process while the container was running. Since SIGINT, the interrupt signal, has code 2, the exit code becomes 130. In practice, you rarely see it unless a developer stops the container on purpose. You can produce this code artificially by creating a container such as mysql interactively (-it) and pressing Control + C repeatedly. 

[root@docker-node02 ~] docker ps -a --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'
 NAMES               IMAGE               STATUS
sharp_knuth         mysql:8             Exited (130) 58 seconds ago

error code 137

In short, there may not be enough memory.

If containers keep dying with error 137 when running with Docker on macOS, try changing the maximum available memory. Select Docker Desktop > Preference, then change the maximum memory size.

exit code 137 & 143: (128+9, 15) The container received SIGKILL and SIGTERM

When you use the docker stop command, the docker daemon sends SIGTERM to the container's init process; this is generally called a graceful exit. If the container has not exited after a certain time, SIGKILL is sent, and the exit code then becomes 137. The timeout after which docker stop switches to SIGKILL can be set in seconds with the -t flag of docker stop, and the default is 10 seconds. 

[root@docker-node02 ~] docker stop --help

Usage:    docker stop [OPTIONS] CONTAINER [CONTAINER...]

Stop one or more running containers

Options:
  -t, --time int   Seconds to wait for stop before killing it (default 10)

The docker kill and docker rm -f commands also use the SIGKILL signal, so the exit code is likewise 137. For reference, SIGKILL is also used to force-terminate a container on OOM caused by insufficient memory resources, so the code is 137 in that case too. 

[root@docker-node02 ~] docker run -itd --name test busybox
464960f8e54857810c17043cc7cec1b50f98abe74ebb7554e6c3a376415117f5

[root@docker-node02 ~] docker stop test
test

[root@docker-node02 ~] docker ps -a --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'
NAMES               IMAGE               STATUS
test                busybox             Exited (137) 3 minutes ago

exit code 255: The exit code is out of range

Applies when the error code is -1, i.e., an obvious error. It is best to check the error logs emitted by the service inside the container.

Tree view

Use dockviz: 

$ docker run -it --rm -v /var/run/docker.sock:/var/run/docker.sock nate/dockviz images --tree

Docker vs Vagrant

Docker vs Vagrant

Check out this infographic comparing Vagrant and Docker:

  • Docker is recommended when you need isolation from the main environment and need to create multiple VE images quickly.
  • Docker is recommended for testing, debugging, and various scenarios.
  • Vagrant is recommended when the entire virtual environment needs to be separated.

Troubleshooting

Cannot install gcc

gcc sometimes fails to install properly in the Ubuntu docker image. In that case, enter the commands below first. 

RUN echo "deb http://cn.archive.ubuntu.com/ubuntu/ trusty main universe multiverse restricted" > /etc/apt/sources.list
RUN echo "deb http://cn.archive.ubuntu.com/ubuntu/ trusty-updates main universe multiverse restricted" >> /etc/apt/sources.list

Error getting IP address: Something went wrong running an SSH command 

Machine default already exists in VirtualBox.
Starting machine default...
(default) Starting VM...
Too many retries waiting for SSH to be available.  Last error: Maximum number of retries (60) exceeded
Regenerate TLS machine certs?  Warning: this is irreversible. (y/n): Regenerating TLS certificates
Detecting the provisioner...
Error getting SSH command: Something went wrong running an SSH command!
command : cat /etc/os-release
err     : exit status 255
output  :
Setting environment variables for machine default...


                        ##         .
                  ## ## ##        ==
               ## ## ## ## ##    ===
           /"""""""""""""""""\___/ ===
      ~~~ {~~ ~~~~ ~~~ ~~~~ ~~~ ~ /  ===- ~~~
           \______ o           __/
             \    \         __/
              \____\_______/


Error getting IP address: Something went wrong running an SSH command!
command : ip addr show dev eth1
err     : exit status 255
output  :
docker is configured to use the default machine with IP
For help getting started, check out the docs at https://docs.docker.com

Error checking TLS connection: Error getting driver URL: Something went wrong running an SSH command!
command : ip addr show dev eth1
err     : exit status 255
output  :

Remove the default machine as below, then install it again. 

$ docker-machine rm default
$ docker-machine create --driver virtualbox default

Adjust memory and swap accounting

When users run Docker, they may see these messages when working with an image: 

WARNING: Your kernel does not support cgroup swap limit. WARNING: Your
kernel does not support swap limit capabilities. Limitation discarded.

To prevent these messages, enable memory and swap accounting on your system. Enabling memory and swap accounting does induce both a memory overhead and a performance degradation even when Docker is not in use. The memory overhead is about 1% of the total available memory. The performance degradation is roughly 10%.

To enable memory and swap on system using GNU GRUB (GNU GRand Unified Bootloader), do the following:

Edit the /etc/default/grub file: 

GRUB_CMDLINE_LINUX="cgroup_enable=memory swapaccount=1"

Update GRUB: 

$ sudo update-grub

IP forwarding problems 

DNS resolver found in resolv.conf and containers can't use it

If the problem above occurs, you need to Diable the dnsmasq service or change Docker's DNS server. The Docker daemon configuration file is at /etc/docker/daemon.json; add the following content. 

{
    "dns": ["8.8.8.8", "8.8.4.4"]
}

Then restart the service. 

$ sudo service docker restart

Unable to fetch some archives

When using apt-get in Docker, the following message may be output. 

E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

See Advanced Package Tool#Unable to fetch some archives.

OCI runtime create failed 

docker: Error response from daemon: OCI runtime create failed: container_linux.go:346: starting container process caused "exec: \"$ECHO_CMD\": executable file not found in $PATH": unknown.

An error that occurs at run time. Check the error message that follows it. Note that environment variables entered in ENTRYPOINT and the like may not work properly, for the reason below. 

$ docker inspect example
...
            "Entrypoint": [
                "$ECHO_CMD"
            ],
...

Checking with the inspect command shows that it runs the environment variable directly, without going through bash or sh. In this case, environment variables set with ENV are not loaded. So run it through bash or sh, as in bash -c "{COMMAND}".

Dockerfile build remove source code from final image

Notes on how to keep code copied with COPY out of the final image. Use a multi-stage build. 

FROM alpine AS builder
RUN apk add --no-cache <build_dependencies>
COPY source_code /tmp/source_code
RUN make -C /tmp/source_code && \
        mkdir /libraries/
        cp /tmp/lib/* /libraries/
        rm -rf /tmp/*

FROM alpine
RUN apk add --no-cache <runtime_dependencies>
COPY --from=builder /libraries/ /libraries/

Alternatively, use the experimental --squash option.

Cannot create an item in a locked collection

If you get the error below when trying to log in to docker with the docker login command in an Ubuntu terminal, you can fix it as follows. 

Remote error from secret service: org.freedesktop.Secret.Error.IsLocked: Cannot create an item in a locked collection
Error saving credentials: error storing credentials - err: exit status 1, out Cannot create an item in a locked collection.

Install gnupg2. gnupg2 is a digital signature and certificate encryption tool for secure communication and data storage. 

$ sudo apt install gnupg2 pass

Logging in again prints the output below. Result: 

Password:
    WARNING! Your password will be stored unencrypted in /home/User_id/.docker/config.json.
    Configure a credential helper to remove this warning. See
    https://docs.docker.com/engine/reference/commandline/login/#credentials-store

    Login Succeeded

A warning says your password is stored unencrypted at the local path /home/User_id/.docker/config.json, and the login succeeds. If you don't like your password being stored this way, go to the address given with the warning and follow the guide.

For reference, it is stored in the following format. 

{
    "auths": {
        "registry.my.com": {
            "auth": "********"
        }
    },
    "HttpHeaders": {
        "User-Agent": "Docker-Client/18.09.7 (linux)"
    }
}

Container loaltime

When the Host is Linux or MacOS

1. Set the Host's localtime (if it is already set correctly, skip to step 2) 

ln -sf /usr/share/zoneinfo/Asia/Seoul /etc/localtime

2. Bind the Host's localtime file read-only (ro) and run the Docker Container. 

docker run -v /etc/localtime:/etc/localtime:ro ...

When the Host is Windows

Run the Docker Container with the time zone environment variable set. 

docker run -e "TZ=Asia/Seoul" ...

Bash script 

#!/bin/bash
export DEBIAN_FRONTEND=noninteractive
ln -fs /usr/share/zoneinfo/America/New_York /etc/localtime
apt-get install -y tzdata
dpkg-reconfigure --frontend noninteractive tzdata

name must be valid as a dns name component

The following error may occur when setting up a swarm. 

... desc = name must be valid as a dns name component

Network names created through a stack must take the form <stack_name>_<network_name>. Make sure the stack name does not contain characters such as a dot (.).

Using a dollar sign ($) in YAML files

A dollar sign ($) in the yaml file used by docker-compose is expanded as an environment variable. To prevent this and use the dollar ($) character literally, use a double dollar ($$; double-dollar sign).

invalid reference format

If a build prints only the invalid reference format message and nothing else, check the image name. Some characters, such as _, are not allowed.

No space left on device

Bottom line: it is an inode problem. See No space left on device#Docker for details.

FromAsCasing 

 1 warnings found (use docker --debug to expand):
 - FromAsCasing: 'as' and 'FROM' keywords' casing do not match (line 5)

The casing of the FROM and as keywords does not match. Make the casing consistent.

LegacyKeyValueFormat 

 2 warnings found (use docker --debug to expand):
 - LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 7)
 - LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 8)

The ENV instruction uses the ENV key value format, which is outdated. The ENV key=value format should now be used.

Unable to enable OPEN PORT rule 

Error response from daemon: failed to set up container networking: driver failed programming external connectivity on endpoint openclaw-openclaw-gateway-1 (b71625d5655ded7ebc04f7f26dd9a696d61d5451fdd812db8abd858140440cc6): Unable to enable OPEN PORT rule:  (iptables failed: iptables --wait -t filter -I DOCKER ! -i br-8fee1f7b395e -o br-8fee1f7b395e -p tcp -d 172.18.0.3 --dport 18789 -j ACCEPT: iptables: No chain/target/match by that name.
 (exit status 1))

Docker is trying to create its own iptables chain (DOCKER), but it is being blocked by user settings.

Reinitialize the Docker network: 

sudo systemctl restart docker

When Docker restarts, it automatically adds the required chains, such as DOCKER and DOCKER-ISOLATION-STAGE-1, to iptables.

If that still doesn't work, the order matters: reapply the iptables rules, then restart Docker: 

# iptables 규칙 적용
sudo iptables-restore < /etc/iptables/rules.v4  # 또는 해당 파일 경로

# 반드시 그 후에 Docker 재시작
sudo systemctl restart docker

The key is the order apply iptables rules → restart Docker. This is because Docker adds its own chains on top of the existing rules when it starts.

Container orchestration

See also

  • Docker Ecosystem
  • Vagrant
  • Fig
  • Heroku & Dokku
  • Packer: General-purpose machine/container image builder.
  • OpenVSwitch
  • LXC
  • Packer
  • Podman: Podman is a daemonless command-line tool for creating and managing container images. Because it lets you work with containers without a runtime environment, you can manage the permissions granted to software components more tightly.
  • Buildah: Buildah is a build tool that lets you control how image layers are committed during a build and how data is accessed. It needs no container runtime to use, and does not require root privileges either. Because Buildah does not include build tools in the image itself, it reduces the size of the images you build.
  • Skopeo: Skopeo is a flexible utility that can move, sign, and verify images between registry servers and container hosts. With Skopeo you can inspect images outside the system.
  • UnionFS (Union File System)
  • ForeverVM - A sandbox for safely running and maintaining AI-generated code
  • Landrun - Sandboxing any Linux process with Landlock, without root or containers
  • Apptainer - Application containers for Linux
  • Minimal - A collection of container images with minimal CVE vulnerabilities
  • docker-wine
  • Dozzle - Real-time log viewer for containers
  • Regclient (regctl)

Favorite site

How to install

Get Started

Welcome! We are excited that you want to learn Docker. The Docker Get Started Tutorial teaches you how to:

  1. Set up your Docker environment (Orientation)
  2. Build an image and run it as one container (Containers)
  3. Scale your app to run multiple containers (Services)
  4. Distribute your app across a cluster (Swarms)
  5. Stack services by adding a backend database (Stacks)
  6. Deploy your app to production (Deploy your app)

Tutorial

Guide

Deploy guide

Tip

Article

References

  1. Docker_Tutorials_GUI_-_ROS_Wiki.pdf ↩

  2. Docker_tutorial_by_nacyot.pdf ↩

  3. Blog.nacyot.com_-_To_deploy_Ruby_on_Rails_applications_to_Docker.pdf ↩

  4. Running_a_Docker_Rails_Development_Environment.pdf ↩

  5. Pyrasis-com.tar.gz ↩

  6. Lekdw-Docker_connected_to_the_external_network.pdf ↩

  7. 20_Awesome_Docker_Containers_for_a_Desktop_User.pdf ↩

  8. Container-orchestration-with-docker-swarm.pdf ↩

  9. Zero-downtime-docker-deployment.pdf ↩

  10. Dockerizing_a_NodeJS_web_app_-_Node.pdf ↩

  11. Docker_Reference_Architecture_-_Designing_Scalable_Portable_Docker_Container_Networks.pdf ↩

  12. 44bits_-_is-docker-container-a-virtual-machine-or-a-process.pdf ↩

author Zer0 sitemap