The docker command-line tool is the day-to-day interface for working with containers and images. docker run creates and starts a new container from an image, accepting many flags at once: -d for detached mode, -p for port mapping, -v for volume mounts, --name to assign a name, -e for environment variables, --network to choose a network, --restart for restart policies, and many more. docker build creates an image from a Dockerfile in the current directory, with -t to tag, -f to specify a different Dockerfile, --no-cache to ignore cache, and --build-arg to pass ARG values. Once containers are running, docker ps lists them (with -a to include stopped ones, -q for IDs only, and --filter to narrow by status), docker logs retrieves their stdout and stderr (with -f to follow, --tail to limit output, --since for time ranges, and -t for timestamps), and docker exec runs a new command inside a running container, commonly docker exec -it mycontainer bash for an interactive shell.
A container's lifecycle includes several states: created (docker create), running (docker start or docker run), paused (docker pause, which uses the cgroup freezer to suspend processes without freeing memory), stopped (docker stop, which sends SIGTERM then SIGKILL after a default 10-second grace period), and removed (docker rm). The difference between docker stop and docker kill is that kill sends a signal immediately (default SIGKILL) with no grace period, while stop allows graceful shutdown. docker rm -f forces removal of a running container, docker rm -v also removes anonymous volumes attached to the container, and docker container prune cleans up all stopped containers. To restart a container with new resource limits, docker update can change --memory, --cpus, and the restart policy without recreating it.
For moving images and data around, the CLI offers a rich set of subcommands. docker pull and docker push transfer images between registries, docker save and docker load export images to and from tarballs (useful for air-gapped environments), and docker export and docker import work on flattened container filesystems without layers or history. docker cp copies files between a container and the host in either direction, docker diff shows filesystem changes inside a container, docker top lists running processes, docker port shows current port mappings, and docker stats streams live resource usage. docker tag adds a new tag to an existing image without copying data, docker rmi removes images (or docker image rm as the modern form), and docker commit creates an image from a container's current state, though this is considered an anti-pattern because it bypasses Dockerfile reproducibility. Cleanup is handled by the family of prune commands: docker system prune, docker image prune (add -a for all unused images, not just dangling), docker container prune, and docker volume prune. The umbrella command docker system df shows disk usage, docker info reports daemon configuration, and docker context lets you switch between multiple Docker hosts.