Docker Cheat Sheet

Docker packages an application and everything it needs to run into a portable image, then runs it as an isolated container. On this site it's the standard way to reproduce a specific vulnerable version of real software for practice, without installing it directly on your own machine.

Red Team / Offensive Use

Docker's role in an engagement or lab context is almost always infrastructure, not the target itself: standing up an isolated copy of a specific vulnerable application to practice against (exactly what every CVE lab on this site does), running attack tooling (C2 frameworks, phishing infrastructure) in a disposable, easily-torn-down environment, or pivoting infrastructure like a relay or proxy container on a VPS. Understanding it well also matters defensively — misconfigured containers (exposed Docker sockets, unnecessarily published ports, containers run with excessive privileges) are a real and common finding in cloud/infrastructure assessments.

Established Cheatsheet

Docker CLI reference and the Compose CLI reference — the official documentation for every command and flag.

PWNMI's Top 7 Use Cases

• docker compose up -d — start everything defined in a docker-compose.yml, detached; the standard first command for every lab on this site
• docker compose logs <service> — check a specific service's output; the first place to look when something isn't responding
• docker compose ps -a — list all containers including ones that crashed or exited; plain ps hides these
• docker inspect $(docker compose ps -q <service>) --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' — get a container's own IP address, the standard way to reach a lab that deliberately publishes no ports
• docker compose exec <service> sh — get an interactive shell inside a running container, useful for inspecting state directly rather than only through the application's own interface
• docker compose down -v — tear a lab down completely, including named volumes, so the next run starts clean
• docker system prune -a --volumes — reclaim disk space from stopped containers, unused images, and volumes once you've accumulated a few labs' worth of leftovers

Next step

New to Docker entirely? Start with Docker for Security Labs for the concepts and the isolation pattern behind every command here. To see it applied against a real CVE, see CVE-2026-62183 (Apache Syncope).