Windows Containers Operations Cheat Sheet

Get-ComputerInfo -Property WindowsProductName, WindowsVersion, OsBuildNumber, OsArchitecture
Get-WindowsFeature -Name Containers, Hyper-V
Get-Service -Name docker, containerd -ErrorAction SilentlyContinue | Select-Object Name, Status, StartType
docker version
docker info

Note: These checks do not install or restart anything. Docker CLI is an external executable, not a PowerShell module, and its commands do not implement PowerShell WhatIf. Verify the active Docker context or endpoint before any mutation.

$image = 'mcr.microsoft.com/windows/servercore:ltsc2025'
docker pull $image
docker image ls --digests --filter reference='mcr.microsoft.com/windows/servercore:*'
docker image inspect $image --format '{{.Os}} {{.OsVersion}} {{.Architecture}}'
docker image inspect $image --format '{{json .RepoDigests}}'

Note: Pull only after matching the selected image release and isolation mode to the host compatibility table. A local image ID is host-local; preserve a registry digest or signed supply-chain attestation for deployment identity.

@'
# escape=`
FROM mcr.microsoft.com/windows/servercore:ltsc2025
WORKDIR C:\app
COPY publish\ .\
USER ContainerUser
ENTRYPOINT ["C:\\app\\Contoso.Web.exe"]
'@ | Set-Content -LiteralPath '.\Dockerfile' -Encoding ascii

docker build --pull --tag contoso/webapp:2026.08 .
docker image inspect contoso/webapp:2026.08 --format '{{json .RepoDigests}}'

Note: The file-writing step is intentionally scoped to a project Dockerfile placeholder. Set-Content overwrites an existing file and Docker build has no WhatIf; review the repository diff, context exclusions, base digest, and executable path before use. RepoDigests is empty until content is associated with a registry repository.

docker container ls --all --no-trunc
docker run --rm --isolation=hyperv mcr.microsoft.com/windows/servercore:ltsc2025 cmd.exe /S /C ver
docker run --detach --name webapp-test --isolation=hyperv --memory 1g --publish 127.0.0.1:8080:8080 contoso/webapp:2026.08
docker container inspect webapp-test

Note: Run commands are change examples, not previews. Confirm that webapp-test is unused, port 8080 is available, the image digest is approved, virtualization is present, and the workload has no unexternalized state before execution.

docker volume ls
docker network ls
docker network inspect nat
docker container inspect webapp-test --format '{{json .Mounts}}'
docker container inspect webapp-test --format '{{json .NetworkSettings.Ports}}'

Note: Do not delete an apparently unused volume until ownership, retention, backup, and restore have been verified. Docker volume prune and network prune have no WhatIf and are intentionally omitted.

$name = 'webapp-test'
docker logs --timestamps --tail 100 $name
docker stats --no-stream $name
docker container inspect $name --format '{{json .State}}'
# After replacement approval and external state verification:
docker stop --time 30 $name
docker container rm $name

Note: The final two commands mutate state and cannot be previewed. Removing a container permanently discards its writable layer; named volumes remain, but anonymous-volume and bind-mount handling must be verified separately.