Getting the flags right without reading the whole manual
The Docker CLI has close to sixty flags on run alone, and most people only need eight or nine of them in a normal day. This page fills in a form instead, and the table below explains what each flag you can toggle changes, including the two that cause the most confused bug reports: port order and the interaction between --rm and -d.
What each flag in the generated command does
| Flag | Effect | Watch for |
|---|---|---|
-d | Runs the container in the background and returns the prompt right away | Combine it with --rm for a container you plan to inspect, and any crash log disappears with the container |
-i -t | Opens a pseudo terminal and keeps standard input attached | Needed for an interactive shell, unnecessary on a web server or database that only listens on a port |
--rm | Deletes the container the moment it stops | Nothing to restart or inspect afterward, so pair it with detached mode only when you are done debugging |
--privileged | Gives the container the same device access as the host | Almost never required for a web app or database image, treat a request for it as a reason to check what the image needs |
--name | Assigns a fixed, reusable name to the container | A second run with the same name fails until the first container is removed with docker rm |
-p host:container | Maps a port on your machine to a port inside the container | Host port comes first. Swap the two and the service stays unreachable even though the container is running |
-e KEY=value | Sets an environment variable inside the container | Visible in docker inspect and to anyone with shell access to the host, so this field is for configuration, not production secrets |
-v host:container | Mounts a path from your machine into the container | A relative path only resolves if the drive is shared with Docker Desktop first, see below |
--network | Attaches the container to a mode or a named network | Host mode skips port mapping entirely, so filling in ports above has no effect once host is selected |
Port order is the single most common mistake on this page.-p 8080:80 means visitors reach the container on your port 8080, and the container itself listens on 80. Write it backwards as -p 80:8080 and Docker binds port 80 on your machine to a port the container is not using, so the app looks broken even though the container starts fine.
Run, build, compose, and exec answer four different questions
The four buttons at the top are not variations of one command, they are separate operations that happen to share a form.
- Run creates a new container from an existing image and starts it. This is the tab most people want when they say "start Docker".
- Build only emits the tagging command,
docker build -t image .. It needs a Dockerfile sitting in the same directory as the trailing dot, which this tab does not write for you. - Compose writes a single-service
docker-compose.ymlfrom the same ports, environment variables, and volumes you already entered, so you can bring the same setup up with one command later. - Exec attaches to a container that is already running. Type a name that is not currently running and Docker answers with "No such container", not a fresh start.
Reading the Dockerfile tab
The Dockerfile tab looks at your image name and picks one of three short templates: Node, Nginx, or a generic fallback for everything else. It is a starting point for a quick test, not a production build. A real image usually needs a multi-stage build, a non-root user, and a pinned base tag, none of which this shortcut adds.
For anything you plan to deploy, build the Dockerfile with the dedicated Dockerfile Generator instead, which covers multi-stage builds and a non-root user by default.
Network modes in one table
| Mode | What it does | Typical use |
|---|---|---|
| Default | Docker's standard bridge network, with the ports you mapped published to the host | Almost every single-container setup |
| Bridge | Same as default, written explicitly with --network bridge | Scripts that prefer an explicit flag over Docker's implicit choice |
| Host | Shares the host's network stack directly, no port mapping involved | Native Linux hosts needing the lowest possible network overhead. On Docker Desktop for Mac or Windows it behaves differently and rarely does what people expect |
| None | No network interface at all beyond loopback | A batch job or CLI tool that never needs to send or receive network traffic |
| Custom | Joins a named network you created with docker network create | Letting several containers reach each other by container name instead of an IP address |
Volume paths and the Windows drive-sharing catch
A bind mount like ./data:/var/lib/data only works if Docker Desktop has been granted access to the drive the path sits on. On Windows and macOS this is a setting inside Docker Desktop, not something a browser page can check or set for you. If a mount silently shows an empty folder inside the container, that setting is the first place to look, followed by confirming the host path exists before the container starts.
Limits worth knowing before you rely on this
- Compose output covers one service. A real stack with an app, a database, and a cache needs assembling those blocks by hand, or a dedicated multi-service editor such as the Docker Compose Generator.
- Nothing here talks to a Docker daemon. A malformed image tag, a typo in a path, or a port already in use is only caught once you run the copied command in a real terminal.
- Environment values sit in plain text in both the command and the file output. Anything secret belongs in Docker secrets, a mounted file with restricted permissions, or a vault, never in this field.
- Privileged mode and host networking generate on request without a warning banner. Treat both as deliberate, occasional choices rather than defaults for an ordinary web app or database container.
- The Dockerfile tab is a sketch, not a build system. It has no opinion on caching layers, image size, or a non-root user, which the standalone generator linked above does address.
Everything above runs as JavaScript in this tab. No image is pulled, no container starts, and no field you fill in leaves the page, since generating a command is string building in the browser. Copy the result into a terminal to run it, and nothing you typed is kept once you close the tab.
