docker run builder and explainer

Paste a docker run command — with \ line continuations, quotes, sudo, a leading $, even PowerShell backticks — or fill in the form; each updates the other. Everything happens in the page; nothing is run.

How to use it

Build & explain — the command at the top, the form below it, and beside it a line per flag saying what it does: -p with host IP and protocol (and whether that’s all interfaces), -v and --mount (bind, named or anonymous volume, :ro), --tmpfs, -e and --env-file, --network and aliases, --restart, --user, -w, --entrypoint versus the command, --cpus/--memory, the --health-* options, labels, --cap-add/--cap-drop, --privileged, --read-only, --security-opt, logging, and the rarer ones. Choose one option per line or a single line.
Warnings — ports published on 0.0.0.0 (reachable from your network, and Docker’s iptables rules bypass ufw and firewalld), --privileged, the Docker socket mounted into the container (root on the host), :latest or untagged images, host namespaces, powerful capabilities, secrets passed with -e, --memory 512 (bytes!), --rm with --restart (Docker refuses), and more.
Compose ↔ run — the current command as a Compose service (ports, volumes, tmpfs, environment, healthcheck, logging, cap_add, …) with notes on what has no Compose equivalent (--rm, -d, -P). Paste a docker-compose.yml to get the equivalent commands in start-up order: docker network create and docker volume create with Compose’s <project>_name naming, a docker build for services with build:, and a docker run per service with its service name as a network alias — plus notes on what doesn’t map (depends_on conditions aren’t waited for, replicas, profiles, secrets become read-only bind mounts). Edit in the form loads one service into the first tab.

Limits

The command reader handles POSIX quoting and continuations; it doesn’t expand $VARIABLES or $(…) — they stay as written. Anything after |, ; or && is ignored (and it says so).
Options it doesn’t know are kept as they are and reported, not explained.
Compose → docker run uses the Compose file’s own defaults for ${VAR:-default}; variables without a default become empty. Use the Compose visualiser with a .env to see the effective values.

Linking to an example

Share link copies a link with the command. Short commands stay readable, as ?cmd=…; longer ones are packed into ?s=. -e values that look like secrets are removed first (they become -e NAME, passed through from the environment). On the Compose ↔ run tab the link also carries the Compose file, with secret-looking values replaced. Tabs: #build, #compose.

Parameter Meaning Example

Parameter	Meaning	Example
`cmd`	The docker run command, URL-encoded	`cmd=docker%20run%20—rm%20-it%20alpine:3.20%20sh`

cmd

The docker run command, URL-encoded

cmd=docker%20run%20—rm%20-it%20alpine:3.20%20sh

For example ?cmd=docker run -d -p 8080:80 -v /var/run/docker.sock:… nginx shows three warnings in one line. The presets on the page — nginx bound to localhost, PostgreSQL with a volume and healthcheck, a throwaway shell, a hardened service and a risky one — are a click away.