Container Operations

Operate containers as replaceable processes. Preserve evidence before restarting, and keep data recovery separate from container replacement.

Establish current state

docker ps --all
docker compose ps
docker compose top
docker stats --no-stream
docker system df

Record the container name, image digest, state, exit code, health, restart count, and recent events.

docker inspect app \
  --format 'image={{.Image}} state={{.State.Status}} exit={{.State.ExitCode}} health={{if .State.Health}}{{.State.Health.Status}}{{end}}'
docker events --since 30m --until "$(date -Iseconds)"

Read logs before restarting

docker logs --since 30m --timestamps app
docker compose logs --since 30m --timestamps app
journalctl -u docker --since '-30 minutes' --no-pager

Container logs normally contain stdout and stderr from the main process. If the application writes only to files inside its writable layer, those logs can disappear with the container; configure the application to emit operational logs to stdout/stderr or a managed log destination.

Inspect from inside carefully

docker compose exec app sh
docker compose exec app id
docker compose exec app env
docker compose exec app wget -qO- http://127.0.0.1:3000/health

Avoid editing a running container to create a permanent fix. Capture the finding, update the image or Compose definition, and replace the container. Be careful with env: its output may contain credentials.

Deploy an immutable version

export APP_VERSION=2026.08.13-3f28c1a
docker compose pull app
docker compose up -d --no-deps app
docker compose ps app
docker compose logs --tail=100 app
curl -fsS https://api.example.com/health

Record the resolved image digest. For rollback, set APP_VERSION to the last known-good artifact and repeat the same commands and verification. A single Compose replica can briefly stop during replacement; use multiple instances behind a load balancer when the service cannot tolerate that interruption.

Back up persistent data

A volume is not a backup. Use the database’s native backup tool for consistent database backups. For file data, coordinate application writes before copying and test restoration into a separate volume or environment.

docker volume inspect project_db_data
docker compose exec -T db \
  pg_dump -U cubis -d cubis -Fc > cubis.dump

Protect the dump as production data. Verify it with the corresponding restore tool in an isolated database before depending on it.

Reclaim space deliberately

docker system df -v
docker image ls
docker container ls --all
docker volume ls
docker image prune

Start with dangling images. Do not add --volumes or run broad docker system prune on a shared or unfamiliar host until every candidate has an owner and recovery plan.

Reduce runtime privilege

• Run the image as a non-root user.
• Avoid privileged, host PID/network namespaces, host devices, and Docker socket mounts.
• Drop capabilities the process does not need.
• Use a read-only root filesystem with explicit writable paths.
• Set CPU, memory, process, and log limits appropriate to the workload.
• Keep the engine, host kernel, base images, and application dependencies patched.

References

• Docker command-line reference
• Docker daemon logs
• Compose production guidance
• Docker security