Incident guide · Containers
Docker, Kubernetes, Helm, and IaC cheat sheet
Inspect Docker, Kubernetes, Helm, Terraform, and Ansible state with bounded, read-only commands and local validation.50explained commands3practical sections100%concrete examples
24
Docker runtime
Confirm context, daemon activity, container health, logs, and resource state.
Show the active Docker context and endpointdocker context show && docker context inspect --format '{{json .Endpoints.docker.Host}}' "$(docker context show)"Read-only
Show running Docker containersdocker psRead-only
List container health checks and current statusdocker ps --format '{{.Names}}' | xargs -r docker inspect --format '{{.Name}} {{if .State.Health}}{{.State.Health.Status}}<else>no-healthcheck<end>'Read-only
Read recent Docker daemon eventsdocker events --since 10m --until 0s --format '{{.Time}} {{.Type}} {{.Action}} {{.Actor.Attributes.name}}' | tail -20Read-only
Take a one-shot container resource snapshotdocker stats --no-streamRead-only
Follow the last 100 log lines from a containerdocker logs -f --tail 100 <container>Read-only
Show Docker disk usagedocker system dfRead-only
Start a Compose stack in the backgrounddocker compose up -dcaution
List local Docker imagesdocker image lsRead-only
Inspect a container as structured JSONdocker inspect <container>Read-only
Open an interactive shell in a running containerdocker exec -it <container> /bin/shcaution
Follow logs from a Compose servicedocker compose logs -f --tail 100 <service>Read-only
Remove unused dangling Docker imagesdocker image prunedanger
List unhealthy Docker containers with their health outputdocker ps --filter health=unhealthy --format '{{.ID}}\t{{.Names}}\t{{.Status}}'Read-only
Map every container to its bind mounts and volumesdocker ps -aq | xargs docker inspect --format '{{.Name}}{{range .Mounts}}\t{{.Type}}:{{.Source}} -> {{.Destination}}<end>'Read-only
Print a container environment in deterministic orderdocker inspect --format '{{range .Config.Env}}{{println .}}<end>' <container> | sortRead-only
Show container names and addresses on a Docker networkdocker network inspect <network> --format '{{range $id, $c := .Containers}}{{$c.Name}}\t{{$c.IPv4Address}}\t{{$c.MacAddress}}<println><end>'Read-only
Inspect Docker image layers with full commands and sizesdocker history --no-trunc --format '{{.Size}}\t{{.CreatedBy}}' <image>Read-only
Extract recent error-level lines from a containerdocker logs --since <minutes>m --timestamps <container> 2>&1 | rg -i 'error|fatal|panic|exception' | tail -<count>Read-only
Render and validate the resolved Docker Compose configurationdocker compose -f <file> config --quiet && docker compose -f <file> configRead-only
Create a compressed backup of a Docker volumedocker run --rm -v <volume>:/source:ro -v <destination>:/backup alpine tar -czf /backup/<archive-file> -C /source .caution
Print a sortable one-shot Docker resource tabledocker stats --no-stream --format '{{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.NetIO}}\t{{.BlockIO}}' | sort -k2 -hrRead-only
Inventory repository tags, IDs, sizes, and immutable digestsdocker image ls --digests --format '{{.Repository}}:{{.Tag}}\t{{.ID}}\t{{.Size}}\t{{.Digest}}'Read-only
Rank Kubernetes pods by total container restart countkubectl get pods -A -o json | jq -r '.items[] | [.metadata.namespace,.metadata.name,([.status.containerStatuses[]?.restartCount] | add // 0)] | @tsv' | sort -k3,3nr | head -<count>Read-only
23
Kubernetes and delivery configuration
Inspect cluster, Pod, release, Terraform, and Ansible evidence.
Show Kubernetes node readiness and versionskubectl get nodes -o wideRead-only
Describe a Kubernetes Pod and its recent eventskubectl -n <namespace> describe pod <pod>Read-only
Read logs from the previous Pod container instancekubectl -n <namespace> logs <pod> --previous --tail=100Read-only
Show Helm release status and resourceshelm -n <namespace> status <release>Read-only
Validate Terraform configuration filesterraform validateRead-only
Check an Ansible playbook's syntaxansible-playbook -i <inventory> playbook.yml --syntax-checkRead-only
Rank Kubernetes pods by memory consumptionkubectl top pods -A --no-headers | sort -k4 -hr | head -<count>Read-only
Show recent Kubernetes warning events in chronological orderkubectl get events -A --field-selector type=Warning --sort-by=.lastTimestamp -o custom-columns='TIME:.lastTimestamp,NAMESPACE:.metadata.namespace,REASON:.reason,OBJECT:.involvedObject.name,MESSAGE:.message'Read-only
Inventory every Kubernetes deployment and container imagekubectl get deployments -A -o json | jq -r '.items[] | .metadata as $m | .spec.template.spec.containers[] | [$m.namespace,$m.name,.name,.image] | @tsv' | sortRead-only
Watch a deployment rollout with an explicit timeoutkubectl rollout status deployment/<deployment> -n <namespace> --timeout=<seconds>sRead-only
Print the active Kubernetes context, cluster, user, and namespacekubectl config view --minify -o json | jq -r '.contexts[0].name as $c | .contexts[0].context | "context=\($c) cluster=\(.cluster) user=\(.user) namespace=\(.namespace // "default")"'Read-only
Inventory Helm releases across every namespacehelm list -A -o json | jq -r '.[] | [.namespace,.name,.chart,.app_version,.status,.updated] | @tsv' | sortRead-only
Render a Helm chart and preview its Kubernetes diffhelm template <release> <chart> -n <namespace> -f <file> | kubectl diff -n <namespace> -f -Read-only
Summarize Terraform plan actions by resourceterraform show -json <file> | jq -r '.resource_changes[] | [.address, (.change.actions | join(" -> "))] | @tsv'Read-only
Preview an Ansible playbook with check mode and diffsansible-playbook -i <inventory-file> <playbook-file> --check --diff --limit <host>Read-only
Inspect a multi-platform container image manifestdocker buildx imagetools inspect <image>Read-only
Map resolved Compose services to images and published portsdocker compose -f <file> config --format json | jq -r '.services | to_entries[] | [.key,.value.image,([.value.ports[]?.published] | join(","))] | @tsv'Read-only
Show Helm release revision historyhelm -n <namespace> history <release>Read-only
Render a Helm chart locally for inspectionhelm template <release> ./chart -n <namespace> | head -40Read-only
Show Terraform provider requirementsterraform providersRead-only
List resources tracked in Terraform stateterraform state list | head -30Read-only
Render the resolved Ansible inventory graphansible-inventory -i <inventory> --graphRead-only
List Ansible playbook tasks and tagsansible-playbook -i <inventory> playbook.yml --list-tasks --list-tagsRead-only
03
Connect delivery state to Git
Confirm the source revision and local change summary that produced an image or deployment.