Build docker run, build, and compose commands visually. Set ports, volumes, env vars, resource limits, and security flags. Free, in-browser, no signup.
Docker’s command line is enormous, and almost nobody remembers whether the flag is --memory or --mem-limit, whether read-only volume syntax is :ro or ,readonly, or which order the host and container sides of a port mapping go in. This Docker command builder replaces that guesswork with a form. Fill in an image, ports, mounts, environment variables, resource ceilings, and security options, and a correctly-ordered, line-continued command appears as you type — ready to copy into a terminal. Nothing is uploaded and no Docker daemon is contacted; the tool only assembles text.
It covers the three commands that make up almost all day-to-day Docker usage: docker run for launching a container, docker build for producing an image from a Dockerfile, and docker compose for driving a multi-service stack. Six ready-made presets (Nginx, PostgreSQL, MySQL, Redis, Node.js, Python) populate every panel at once so you can start from a working configuration instead of an empty form.
run, build, or compose. The panels change to show only the options that command accepts.Every flag below is one the builder emits. They are assembled in a stable order — container options, networking, volumes, environment, resources, security, then the image name last — because Docker requires the image argument to follow all options.
| Flag | Panel | What it does |
|---|---|---|
-d | Container | Detached: run in the background and print the container ID. |
-i / -t | Container | Keep STDIN open / allocate a pseudo-TTY. Used together (-it) for an interactive shell. |
--rm | Container | Delete the container filesystem when it exits. Ideal for one-off dev containers. |
--name | Container | A stable name so you can docker exec or docker logs without looking up an ID. |
--restart | Container | no, always, unless-stopped, or on-failure. Controls whether Docker restarts the container after a crash or host reboot. |
-p host:container | Network | Publish a port. Append /udp for UDP. Host side first — the most common ordering mistake. |
--expose | Network | Declare a port as available to linked containers without publishing it to the host. |
--hostname / --network / --dns | Network | Set the in-container hostname, attach to a user-defined network, and override resolvers. |
-v host:container[:ro] | Volumes | Bind-mount a host path. The :ro suffix makes it read-only inside the container. |
--tmpfs | Volumes | Mount a RAM-backed filesystem — the usual companion to --read-only. |
-e KEY=value / --env-file | Environment | Set individual variables, or load them in bulk from a file. |
--memory / --memory-swap | Resources | Hard memory ceiling and the combined memory-plus-swap ceiling. |
--cpus / --cpu-shares | Resources | Fractional CPU quota (1.5 = one and a half cores) and relative weighting under contention. |
--pids-limit | Resources | Cap on process count — the simplest defence against a fork bomb inside a container. |
--user | Security | Run the entrypoint as a specific UID/GID or named user instead of root. |
--read-only | Security | Make the container root filesystem immutable. |
--security-opt no-new-privileges:true | Security | Block setuid binaries from raising privileges after the process starts. |
--cap-add / --cap-drop | Security | Grant or remove individual Linux capabilities. The builder offers the standard list including NET_BIND_SERVICE, NET_RAW, SYS_CHROOT, CHOWN, SETUID, and ALL. |
--privileged | Security | Disables nearly every isolation boundary. Flagged as critical whenever you enable it. |
Take the Nginx preset and read what it produces. The image is nginx:alpine, the container is named nginx-server, port 80 is published, the restart policy is unless-stopped, the process runs as the nginx user, the root filesystem is read-only, privilege escalation is blocked, and every Linux capability is dropped:
docker run -d --name nginx-server --restart unless-stopped -p 80:80 --user nginx --read-only --security-opt no-new-privileges:true --cap-drop ALL nginx:alpine
That is a meaningfully hardened container, and the difference from a bare docker run -d -p 80:80 nginx is six flags that are easy to forget. Add a memory limit in the Resources panel and the advisory warning about unbounded memory disappears.
The build tab emits -t for the image tag, -f for a Dockerfile at a non-default path, --target to stop at a named stage in a multi-stage build, --platform for cross-architecture builds such as linux/arm64, repeatable --build-arg KEY=value pairs, plus --no-cache, --pull, and --squash. The build context path is always emitted last, defaulting to ..
The compose tab covers up, down, build, logs, exec, ps, restart, stop, start, and pull, with the modern docker compose (space, not hyphen) syntax. Global -f and -p flags go before the subcommand; subcommand-specific flags such as -d, --build, --force-recreate, and --remove-orphans for up, or -f and --tail for logs, are only offered where they are valid. That ordering matters: docker compose up -f file.yml is an error, while docker compose -f file.yml up is correct, and the builder never gets it backwards.
Most container escapes and lateral-movement incidents trace back to a handful of defaults nobody changed. A container runs as root unless you say otherwise, has an unbounded memory allowance, keeps a broad default capability set, and can write anywhere in its own filesystem. None of that is required for a typical web server or worker.
The pattern the presets follow — drop ALL capabilities, add back only what the process genuinely needs, set --user to a non-root account, enable --read-only with a --tmpfs for scratch space, set no-new-privileges, and put a number on --memory — costs nothing at runtime and removes most of the easy paths out of a container. If you are also authoring the image, the Dockerfile generator handles the build-time half of the same problem.
No. It only assembles command text in your browser. Nothing is executed, no daemon socket is touched, and the configuration you type is never transmitted anywhere. You copy the result and run it yourself, which means you get a chance to read it first.
The preview inserts backslash line continuations so a long command stays readable on screen. The copy button collapses those into a single line, because pasting multi-line continuations into some terminals and CI configuration files causes trouble. Both forms are equivalent to the shell.
-p and --expose?-p publishes a container port on the host so outside traffic can reach it. --expose only documents that the container listens on a port and makes it reachable from other containers on the same network — it opens nothing on the host.
docker compose or docker-compose?Use docker compose, the v2 plugin syntax that ships with current Docker installations. The hyphenated docker-compose was the standalone Python tool and is no longer maintained. This builder emits the v2 form.
Because a process running as UID 0 inside a container is a much better starting position for an attacker who finds a code-execution bug. Combined with a mounted host path or an added capability, root-in-container is a realistic escape path. Setting --user to a non-root account closes it cheaply.
--privileged actually justified?Rarely: Docker-in-Docker builds, some storage or networking agents, and certain hardware-access workloads. It disables seccomp, AppArmor, and capability restrictions and gives the container access to host devices. Prefer specific --cap-add and --device flags whenever you can identify what the workload actually needs.
--restart unless-stopped do differently from always?Both restart the container after a crash and after a host reboot. The difference is that if you manually stop the container, unless-stopped leaves it stopped across a daemon restart, whereas always brings it back up. For services you occasionally stop on purpose, unless-stopped is usually what you want.
The presets pin sensible tags such as nginx:alpine, postgres:16-alpine, and node:20-alpine as starting points. Check the current supported release for your stack before deploying, and pin an explicit tag rather than latest in anything reproducible.
The .env file generator produces the file that --env-file points at, the .gitignore generator keeps that file out of version control, and the secrets scanner checks whether a credential has already leaked into a Dockerfile or compose file you committed.
Docker commands manage the lifecycle of containers — building images, running containers, managing networks, and orchestrating multi-container applications. While Docker's CLI is powerful, its extensive options and flags make it easy to misconfigure containers, miss security settings, or create inefficient deployments.
This tool generates correct Docker commands for common operations, including proper security flags, resource limits, networking configuration, and volume management — reducing errors and enforcing best practices.
| Command | Purpose | Example |
|---|---|---|
| docker build | Build an image from a Dockerfile | docker build -t myapp:1.0 . |
| docker run | Create and start a container | docker run -d -p 8080:3000 myapp:1.0 |
| docker compose up | Start multi-container applications | docker compose up -d |
| docker exec | Run a command in a running container | docker exec -it myapp sh |
| docker logs | View container output | docker logs -f myapp |
| docker ps | List running containers | docker ps -a |
| docker stop/rm | Stop and remove containers | docker stop myapp && docker rm myapp |
| docker images | List local images | docker images --filter dangling=true |
| docker network | Manage container networks | docker network create app-net |
| docker volume | Manage persistent storage | docker volume create db-data |