Docker MCP Server

Remove all stopped containers to reclaim disk space. Only removes containers that are not running - running containers are never affected. Use `container_list(all=True)` to preview what would be removed before calling this. Valid filter keys: `until` (RFC3339 timestamp or duration like "24h" - removes containers stopped before that point), `label` (key or key=value). For a broader cleanup of containers plus unused images, networks, and volumes see the `prune_managed` prompt. Args: filters: Narrow which stopped containers to remove; omit to remove all stopped Returns: dict: {"ContainersDeleted": [...], "SpaceReclaimed": <bytes>}

Remove a container, deleting its writable layer. The image is untouched (`image_remove` deletes images); named volumes are never removed - volumes=True only covers anonymous ones. A running container is refused unless force=True, which kills it first. When the server runs containerized it refuses to remove its own container. Args: volumes: Also remove anonymous volumes (the CLI's `--volumes`); named volumes persist link: Remove the legacy link named `id_or_name`, not the container force: Kill a running container before removing it (default False: running is an error) Returns: bool: True after removal completes

Rename a container in place; its id, state, and configuration are unchanged. Use it to free up or claim a container name (names are unique per daemon) - e.g. before starting a replacement under the old name. Fails with a conflict error if the new name is already taken. Not related to `image_tag`, which names images. Args: name: The new name; must not be in use by any other container Returns: dict: The container's full inspect payload after the rename

Restart a container: stop then start again in one call. The container receives its configured stop signal (`STOPSIGNAL`, default SIGTERM), SIGKILL after stop_timeout_seconds, and is then started. Use `container_stop`/`container_start` to do the halves separately. When the server runs containerized it refuses to restart its own container. Args: stop_timeout_seconds: Seconds between the stop signal and SIGKILL Returns: dict: The container's full inspect payload after the restart; for an `auto_remove` container already gone, the one from before, with `removed_on_exit: true`

Run a container from an image (create and start in one call, like `docker run`). Returns once the container has started. For a one-shot command set `timeout_seconds` (with `auto_remove`, like `docker run --rm`) to wait for it to exit and get its exit code and output; one still running then is reported `timed_out` and left, never auto-removed: remove it with `container_remove(force=True)`. For a long job, wait with `system_wait` instead. `container_create` prepares one without starting it; `container_exec` runs a command in an existing one. Created containers get provenance labels. Args: environment: Environment variables, as `{"KEY": "value"}` or a list of "KEY=value" strings ports: Port mappings, e.g. {'2222/tcp': 3333} volumes: Volumes to mount, as `{"/host/path": {"bind": "/in/container", "mode": "rw"}}` or a list of "host:container:mode" strings user: Username or UID to run as restart_policy: Restart policy, e.g. {'Name': 'on-failure', 'MaximumRetryCount': 3} labels: Labels to set on the container auto_remove: Delete the container on exit, logs and exit code included; with `timeout_seconds`, after they are read. Not with a restart policy privileged: Give extended privileges to the container mem_limit: Memory limit: bytes as an int, or a units string ("100000b", "1000k", "128m", "1g") cpu_count: Usable CPUs, on a Windows daemon only timeout_seconds: Seconds to wait for exit before returning with timed_out=true extra_kwargs: Additional keyword arguments forwarded to ContainerCollection.run (call `docs_lookup(section="containers")` for the full accepted set) Returns: dict: Without `timeout_seconds`, the started container's full inspect payload; an `auto_remove` container already gone returns the payload from before the start, with `removed_on_exit: true`. With it, {"id", "name", "exit_code", "stdout", "stderr", "timed_out", "truncated", "removed", "error"}: each…

Start an existing stopped container. Use this to restart a container that was previously created or stopped without removing it. To create and start a new container in one step use `container_run` instead. Calling on an already-running container has no effect (the daemon returns 304 and no error is raised). To stop then start a running container use `container_restart`. Returns: dict: The container's full inspect payload after starting; for an `auto_remove` container already gone, the one from before, with `removed_on_exit: true`

Get one point-in-time resource-usage snapshot for a container (non-streaming). Returns the raw engine stats payload; CPU percent must be computed from the delta between `cpu_stats` and `precpu_stats`. By default the daemon collects two cycles before answering, which is what fills `precpu_stats` - so the call takes about a second. `one_shot=True` returns after a single collection instead, leaving `precpu_stats` zeroed and CPU percent uncomputable; use it when only `memory_stats`/`pids_stats` matter. For a pre-computed human-readable summary prefer the `docker-stats://{id_or_name}` resource; for a process listing use `container_top`. Args: one_shot: Skip the second collection cycle for a faster answer, at the cost of an empty `precpu_stats` (so no CPU percent); needs daemon API v1.41+ Returns: dict: Engine stats payload (read, cpu_stats, precpu_stats, memory_stats, networks, pids_stats, ...)

Gracefully stop a running container (its configured stop signal, then SIGKILL after a timeout). Prefer this over `container_kill` for a clean shutdown: the main process receives the container's stop signal (`STOPSIGNAL`, default SIGTERM) and has stop_timeout_seconds to exit before the daemon force-kills it. Use `container_restart` to stop and start again in one call, or `container_pause` to freeze processes without stopping. When the server runs containerized it refuses to stop its own container. Args: stop_timeout_seconds: Seconds between the stop signal and SIGKILL Returns: dict: The container's full inspect payload after the stop (exit code under State.ExitCode); for an `auto_remove` container, which the stop deletes, the one from before, with `removed_on_exit: true`

List the processes running inside a container (the daemon runs `ps` on the host). Works on any running container without executing anything in it, so it needs no shell or `ps` binary in the image - unlike `container_exec` with `ps`. Use `container_stats` for resource usage rather than process lists. Fails if the container is not running. Args: ps_args: Extra ps arguments (e.g. "aux"); default is the daemon's standard ps invocation Returns: dict: {"Titles": [ps column names], "Processes": [[one row of values per process]]}

Resume all processes in a paused container (the reverse of `container_pause`). Only valid on a paused container - it fails if the container is merely stopped; use `container_start` for stopped containers. Processes continue from where they were frozen. Returns: dict: The container's full inspect payload after unpause (State.Paused becomes false)

Update resource limits on a container without recreating it. Changes take effect immediately on Linux (cgroups); not all fields are updatable on every platform. Common `updates` keys: `mem_limit` (bytes, e.g. 134217728 for 128 MB), `memswap_limit` (memory+swap in bytes; -1 = unlimited), `cpu_shares` (relative weight, default 1024), `cpu_period` / `cpu_quota` (microseconds for CFS throttling), `cpuset_cpus` (e.g. "0-1"), `restart_policy` (dict with `Name` such as "on-failure"/"always"/"unless-stopped" and optional `MaximumRetryCount`). To change image, env, or volumes the container must be recreated (`container_remove` + `container_run`). Args: updates: Resource fields to update; see description for valid keys Returns: dict: The container's full inspect payload after the update

Create a new Docker CLI context pointing at a daemon endpoint. Registers a named endpoint for the CLI; switch with `context_use`, enumerate with `context_list`. It does not retarget this server's docker-py client (pinned at startup). Does not raise on a non-zero CLI exit - inspect `returncode`/`stderr`. Args: name: Name for the new context (must not already exist) docker_host: Daemon URL, e.g. "tcp://10.0.0.5:2376" or "unix:///var/run/docker.sock"; no commas description: Human description shown in `context ls` tls_ca: Path on the local host to the CA cert (for TLS daemons); no commas tls_cert: Path on the local host to the client cert; no commas tls_key: Path on the local host to the client key; no commas skip_tls_verify: Disable TLS verification (insecure; for testing only). The only way to set it: it cannot be smuggled through `docker_host` Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

Return the full configuration for a single Docker context. Full endpoint/TLS detail for one context; `context_list` gives the one-line summary of all. Raises RemoteFailureError if the CLI call fails. Args: name: Context name (use the `Name` field from `context_list`) Returns: dict: The parsed `docker context inspect` entry (keys include "Name" and "Endpoints" with the daemon URL)

List Docker CLI contexts known to the host running this MCP server. Contexts are a CLI concept (stored in the docker config dir) letting one CLI target multiple daemons. This server uses whatever DOCKER_HOST / current-context resolved to at startup, so changing contexts only affects future subprocess-based tools, not the docker-py SDK client. Use `context_inspect` for one context's full config and `context_use` to switch. Raises RemoteFailureError if the CLI call fails. Returns: list: One dict per context, keyed as the CLI emits them - `Name`, `Description`, `DockerEndpoint` and `Current`, the last being true for the context the CLI would use by default

Remove a Docker CLI context. Deletes only the CLI's connection metadata - the daemon it pointed at is untouched. The current context needs force=True (or `context_use` another first). Does not raise on a non-zero CLI exit - inspect `returncode`/`stderr`. Args: force: Force removal even if the context is the current one Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

Set the active Docker context for the CLI on the host running this MCP server. Note: this does not retarget the long-lived docker-py client - SDK-backed tools keep using the endpoint they connected to at startup. To retarget those, restart the server with a different DOCKER_HOST / DOCKER_CONTEXT. Create contexts with `context_create`; list them with `context_list`. Does not raise on a non-zero CLI exit - inspect `returncode`/`stderr`. Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

Look up Docker SDK/CLI/registry reference documentation by section. A tool-callable mirror of the docker-docs:// resources, for clients that can't read MCP resources (e.g. Claude Desktop, Cursor). Always registered regardless of DOCKER_MCP_SERVER_DISABLE - looking something up costs nothing and isn't tied to any single Docker feature area - but an individual section still refuses if the domain it documents is disabled, matching the equivalent `docker-docs://{section}` resource exactly. Omit `section` to list every available section with its source URL (same as `docker-docs://contents`); pass a `section` name to fetch that page's content (same as `docker-docs://{section}`). Most useful before constructing an `extra_kwargs`-style passthrough dict for a tool like `container_run`/`container_create`/`service_create` (their docstrings only list common keys, not every key docker-py accepts), or before writing Compose/Dockerfile/buildx bake-file syntax, which no tool generates. Args: section: Section name (from a no-argument call's index); omit to list all sections instead Returns: str: JSON section index (no `section`) or that section's raw HTML/Markdown content

List the Docker hosts configured via DOCKER_MCP_SERVER_HOSTS. With a single host (or the var unset) this is the one resolved daemon; with several it is the set that the `host` argument selects from. The `default` entry is the one used when `host` is omitted; pass a `name` as the `host` argument of daemon-backed tools (`system_ping(host=...)` checks one entry). The `docker-mcp://hosts` resource mirrors this tool. Returns: list[dict]: one per host: name; url (resolved daemon URL, null = docker-py platform default); read_only; non_destructive (blocks destructive calls only); tls (whether a per-host cert dir is configured); default (the omitted-host fallback)

Report the caller's remaining Docker Hub pull-rate-limit budget. Sends a HEAD to the `ratelimitpreview/test` manifest (a HEAD isn't metered as a pull, so the check costs no budget) and reads the RateLimit-Limit / RateLimit-Remaining headers. Call it before a large `compose_pull` / `image_pull` to avoid hitting the cap mid-deploy. Credentials raise the limit and switch metering from per-IP to per-account; falls back to DOCKER_MCP_SERVER_REGISTRY_USERNAME / DOCKER_MCP_SERVER_REGISTRY_PASSWORD, does NOT read `~/.docker/config.json`. Plans with no limit return no headers - reported as `"unlimited": true`. Args: username: Hub username (overrides DOCKER_MCP_SERVER_REGISTRY_USERNAME) password: Hub password/token (overrides DOCKER_MCP_SERVER_REGISTRY_PASSWORD) Returns: dict: {"authenticated", "limit", "remaining", "window_seconds", "unlimited"}

Fetch Docker Hub metadata for a repository. Public repos only: sends no auth and does NOT read the local Docker credential store; private repos return 404/401. Hub-only metadata (stars, pulls, description) - use `registry_tags` for tag lists on any OCI registry and `hub_tags` for Hub tag details. Args: repository: Hub repository, e.g. "library/alpine" or "myorg/myimage" Returns: dict: The Hub /v2/repositories/<repo>/ response (description, star_count, pull_count, last_updated, is_private, etc.)

List tags on a Docker Hub repository with Hub-specific metadata. Hits the Hub UI API (hub.docker.com) for richer per-tag data than `registry_tags` - last pushed date, per-platform sizes, digest. Public repos only: sends no auth and does NOT read `~/.docker/config.json`; private repos return 404/401 (use `registry_tags` against registry-1.docker.io with credentials). Args: repository: Hub repository, e.g. "library/alpine" or "myorg/myimage" limit: Max tags to return (default 100, >= 1); pagination capped at 50 pages Returns: dict: {"name": <repo>, "tags": [{name, full_size, last_updated, digest, images}, ...], "truncated": bool}

Build an image from a Dockerfile using the daemon's classic builder. Use this for simple single-platform builds from a local context. For multi-platform builds, BuildKit cache export/import, or advanced build features prefer `buildx_build`. `path` must be a directory accessible on the host running this server (it is the build context sent to the daemon). `dockerfile` must be inside `path`; one outside it is refused. Args: path: Build context directory path on the server host tag: Name and optional tag in "name:tag" format to apply to the built image quiet: Suppress verbose build output (final image id still returned) nocache: Ignore the layer cache and rebuild all layers rm: Remove intermediate containers on success pull: Always pull a newer version of each FROM base image before building forcerm: Remove intermediate containers even on build failure dockerfile: Dockerfile path inside `path`, relative to it or absolute (default: "Dockerfile") buildargs: Build-time variables passed as `--build-arg`; dict of str to str container_limits: Resource limits for the build container, e.g. {"memory": 134217728} shmsize: Size of /dev/shm in bytes for build steps that need shared memory labels: Labels to set on the resulting image (dict of str to str) cache_from: List of image references to use as layer cache sources target: Stop at this named build stage (multi-stage Dockerfiles) network_mode: Network mode for RUN instructions during build (e.g. "host", "none") squash: Squash all new layers into one (experimental; requires daemon flag) extra_hosts: Additional /etc/hosts entries during build; dict of hostname to IP platform: Target platform, e.g. "linux/amd64" (single platform only; use buildx for multi) isolation: Isolation technology, passed to the daemon as given; platform-dependent, so not validated here (Windows documents "default", "process", "hyperv") use_config_proxy: Forward prox…

Return the layer history of an image. Useful for auditing what commands built each layer and diagnosing image size. Each entry includes `Id` (layer digest or "<missing>" for imported layers), `Created` (unix timestamp), `CreatedBy` (the Dockerfile command that produced the layer, e.g. a RUN or COPY), `Size` (bytes added by that layer), and `Comment`. For full image metadata use `image_inspect` instead. Args: id_or_name: Image name (with optional tag/digest) or id Returns: list: Layer history entries, newest first

Create an image from a flat root-filesystem tarball, like `docker import`. Imports a *filesystem* archive as a new single-layer image with no build history - not the same thing as `image_load`, which restores a `docker save` archive complete with its layers, tags and history, so prefer `image_load` for anything `image_save` produced. Use this for a rootfs that came from somewhere else: a `container_export` archive, a distro base tarball, a VM image dump. The result has an empty config - no `CMD`/`ENTRYPOINT`/`ENV` - unless you supply `changes`, so an imported image is usually not runnable until you set at least a command. Pass exactly one source (`from_file`, `data`, `from_url` or `from_image`). `from_url` and `from_image` are fetched by the *daemon*, `from_file`/`data` are read here and uploaded. Like every image-creating tool it stamps no provenance labels, and here a caller cannot add one either: the Engine's import call accepts no labels field, and `changes` does not cover `LABEL`. Args: repository: Repository name to give the new image, e.g. "myorg/rootfs"; may include a tag (`myorg/rootfs:v1`), and defaults to `:latest` when it does not. Omit to import untagged, addressable only by the id in the returned progress tag: Tag to apply, e.g. "v1". Needs `repository`, and must match any tag already in it from_file: Path to a rootfs tarball on the server host (`~` expanded), read by the server's user data: Rootfs tarball contents in band (base64-encoded by MCP, so prefer `from_file` for anything but small archives) from_url: URL the daemon fetches the tarball from from_image: Name of an existing image to import from, like a Dockerfile `FROM` changes: Dockerfile instructions applied to the new image, e.g. ['CMD ["/bin/sh"]']; only CMD, ENTRYPOINT, ENV, EXPOSE, ONBUILD, USER, VOLUME and WORKDIR are supported. Parsed as real Dockerfile syntax, so shell form is wrapped exactly as a Dockerfile would w…

Return the full inspect detail for a single local image. Includes config (env, entrypoint, exposed ports), size, layer digests (`RootFS.Layers`), and all tags/digests referencing it (`RepoTags`/`RepoDigests`). For a quick overview of many images use `image_list` instead. For the per-layer build history (which command produced each layer) use `image_history`. Only inspects images already present locally - for a remote image's manifest without pulling it use `image_registry_data` or `registry_manifest`. Args: id_or_name: Image name (with optional tag/digest) or id Returns: dict: Full image inspect attrs (equivalent to `docker inspect` on an image)

List images in the daemon's local store. Local only - for a registry's contents use `registry_tags` / `hub_tags`, and `image_search` to find images on Docker Hub. Dangling (untagged) build leftovers show with filters={"dangling": True}. Args: repository: Only show images of this repository all: Show intermediate image layers filters: Filter by attributes (label, dangling, before, since, etc.) Returns: list: One summary dict per image ({"Id", "RepoTags", "RepoDigests", "Created", "Size", "Labels", ...}); use `image_inspect` for a full inspect payload

Load an image from a tarball produced by `image_save`, from in-band bytes or a file on the server host. Counterpart of `image_save`; when the image lives in a registry, `image_pull` is the normal route, and for a flat rootfs archive that is not a `docker save` bundle use `image_import`. Pass exactly one of `data` (tarball bytes in band) or `from_file` (a path on the server host, streamed straight to the daemon - preferred for anything but small images, since in-band bytes are base64-encoded by MCP). `from_file` is read by the server's user; `~` is expanded. Args: data: Tarball contents; exactly one of data/from_file from_file: Path to a tarball produced by `docker save` / `image_save`; exactly one of data/from_file Returns: list: One full inspect payload per loaded image

Remove unused local images to reclaim disk space, and with `build_cache=True` the daemon's build cache too. Without filters removes only "dangling" images - untagged layers not referenced by any tag or container. To remove all images not used by any container (including tagged ones) pass `filters={"dangling": False}`. Valid filter keys: `dangling` (bool as string "true"/"false"), `until` (RFC3339 timestamp or duration like "24h"), `label` (key or key=value). Use `system_df` first to see how much space is reclaimable. The build cache is a separate resource, often the larger one on a machine that builds images; `build_cache=True` prunes its unused records through the Engine API, with `filters` applying to images only. For a non-default builder's cache, cache filters, or a space floor, use `buildx_prune` instead. Args: filters: Narrow which images to remove; omit to remove dangling images only build_cache: Also prune the daemon's unused build cache Returns: dict: {"ImagesDeleted": [...], "SpaceReclaimed": <bytes>}, plus with `build_cache` a "BuildCache" key holding {"CachesDeleted": [...], "SpaceReclaimed": <bytes>}

Pull an image from a registry to the daemon's local store. Private repositories need credentials - `system_login` (or `docker login` on the host) first, or `auth_config` to authenticate this call alone. Use `image_load` for tarballs, and `registry_manifest` / `image_registry_data` to inspect a remote image without pulling it. Security: `auth_config` carries registry credentials, which many MCP clients log verbatim. Prefer `docker login` on the host so the `docker` module reuses credentials cached in `~/.docker/config.json`, and leave `auth_config` unset. Args: tag: The image tag (ignored when all_tags=True) all_tags: Pull all tags from the repository platform: Platform in os/arch format auth_config: Per-call registry credentials under the keys `username` and `password`; overrides the cached credential for this pull only Returns: dict | list: The pulled image's full inspect payload, or one per image if all_tags=True

Push an image or repository to a registry. The local image must already bear the target name - `image_tag` it with the registry-qualified `repository[:tag]` first; a bare name pushes to Docker Hub. Private registries need credentials (`system_login`, or `docker login` on the host). Security: `auth_config` carries registry credentials, which many MCP clients log verbatim. Prefer `docker login` on the host so the `docker` module reuses credentials cached in `~/.docker/config.json`, and leave `auth_config` unset. Args: auth_config: Per-call registry credentials under the keys `username` and `password`; overrides the cached credential for this call only Returns: str: Push output as a string

Get registry data for an image without pulling it, via the daemon's distribution endpoint. Uses the daemon, with the credentials this server's docker client has cached, to resolve the remote descriptor and platform list. For direct registry access without a daemon use `registry_manifest`. Security: `auth_config` carries registry credentials, which many MCP clients log verbatim. Prefer `docker login` on the host so the `docker` module reuses credentials cached in `~/.docker/config.json`, and leave `auth_config` unset. Args: repository: Image reference auth_config: Per-call registry credentials under the keys `username` and `password`; overrides the cached credential for this call only Returns: dict: The registry data document {"Descriptor", "Platforms"} - the OCI descriptor and the platforms available for the reference

Remove a local image by name or id. Fails without `force` if the image is tagged by multiple names (untag first with `image_tag`) or if stopped containers reference it. Running containers always block removal regardless of `force`. `noprune` keeps untagged parent layers that would otherwise be removed as a side-effect; leave False unless you need to preserve the parent layers for another purpose. Args: id_or_name: Image name (with optional tag/digest) or id to remove force: Remove even if referenced by stopped containers or multiple tags noprune: Do not delete untagged intermediate parent layers Returns: bool: True after removal completes

Save an image as a tar archive: to a file on the server host, or in band. The archive keeps layers, tags, and metadata so `image_load` can restore it - different from `container_export`, which flattens one container's filesystem. With `dest_path` the archive streams straight to disk (no byte cap), so it handles large images - the file is written by the server's user, `~` is expanded, and an existing file is refused unless `overwrite=True`. Without `dest_path` the tar bytes are returned in band, capped at `max_bytes` (default 32 MiB) because MCP base64-encodes them - a fallback for when no writable host path exists (e.g. a containerized server without a bind mount). Args: dest_path: Destination path on the server host; omit to return the bytes in band named: Whether to retain repository/tag names in the saved archive overwrite: Replace dest_path if it already exists max_bytes: In-band mode: abort with ToolInputError beyond this many bytes (default 32 MiB) Returns: bytes | dict: the tarball bytes (in band), or {"path": <resolved path>, "bytes_written": int}

Search Docker Hub for public images matching a term. Searches Docker Hub only - not GHCR, ECR, or other registries. For listing tags on a specific image from any OCI registry use `registry_tags` instead. Args: term: Search keyword, e.g. "nginx" or "python" limit: Maximum number of results to return (Docker Hub default is 25) Returns: list: Result dicts: {"name", "description", "star_count", "is_official", "is_automated"} - `is_automated` is deprecated in the Engine API and is always false, so rank on `star_count`/`is_official` instead

Tag an image into a repository (add a name to an existing local image). The image id stays the same and no data is copied - a tag is an alias. Typical flow: tag with the registry-qualified name, then `image_push`. `image_remove` on a tag merely untags while other names remain. Tagging over a name that already exists repoints it, without asking. Args: id_or_name: The source image name or id repository: Target repository name (registry-qualified for pushing, e.g. "ghcr.io/o/r") tag: Tag for the new image (default "latest") Returns: bool: True if the image was tagged

Attach a running container to an additional network without restarting it. Use this to give a container access to services on a network it was not started with. `aliases` sets extra DNS names for this container within the network (other containers can reach it by those names in addition to its container name). `ipv4_address` / `ipv6_address` assign a specific IP on the network; omit to let the driver assign one. `links` is a legacy feature (deprecated; prefer DNS aliases). Use `network_disconnect` to undo. Args: id_or_name: Network id or name to connect the container to container: Container id or name to attach aliases: Additional DNS names for this container within the network links: Legacy container links (deprecated) ipv4_address: Static IPv4 address to assign on this network ipv6_address: Static IPv6 address to assign on this network link_local_ips: Link-local IP addresses to assign driver_opt: Driver-specific endpoint options mac_address: Static MAC address for this endpoint, e.g. "02:42:ac:11:00:04"; per-network rather than per-container, and a driver is free to ignore it Returns: bool: True after the container is connected

Create a network. The daemon default driver is `bridge` (single-host); use `overlay` for swarm-wide networks. Creating a network attaches nothing - connect containers afterwards with `network_connect` or at start via `container_run(network=...)`. Created networks carry provenance labels. A duplicate `name` is always rejected, so creating is not idempotent - check `network_list` first when the network may already exist. Args: driver: Driver name (daemon default `bridge`; `overlay` for swarm scope) options: Driver-specific options dict ipam: IPAM configuration as a dict (engine shape: {"Driver", "Config": [{"Subnet", "Gateway", ...}]}) internal: Restrict external access labels: Labels to set on the network attachable: Allow standalone containers to attach (swarm overlay networks) scope: Network scope; the driver picks a sensible default when omitted ingress: Make this an ingress network for swarm routing-mesh Returns: dict: The created network's full inspect payload

Disconnect a container from a network. The container keeps running with its other network attachments; only this endpoint is removed (the reverse of `network_connect`). A network with connected containers cannot be deleted, so disconnect them before `network_remove`. Args: container: The container id or name to disconnect force: Force the disconnect; use to clear a stale endpoint (e.g. from a deleted container) Returns: bool: True after the container is disconnected

Return the full inspect detail for a single network. Includes the connected containers (`Containers`, keyed by container id, with each entry's assigned IP), IPAM config, and driver options. For a quick overview of many networks use `network_list` instead - its default (non-`greedy`) response omits the per-network `Containers` detail for speed. `verbose` is the swarm-overlay troubleshooting switch: it adds the cluster-wide `Services` breakdown that a plain inspect never carries, which is what shows whether the tasks on other nodes have actually joined the network. Args: verbose: Add the cluster-wide service/peer detail for an overlay network (needs daemon API v1.28+); omit on a single-host network, where it adds nothing scope: Disambiguate when the same name exists at more than one scope; omit to let the daemon choose (needs daemon API v1.31+) Returns: dict: Full network inspect attrs (equivalent to `docker network inspect`); with `verbose` also a `Services` map of service name to its tasks and peers on this network

List networks. Valid filter keys: `driver` (driver name), `label` (key or key=value), `type` ("custom" or "builtin"). `names`/`ids` are a separate shorthand for filtering by name/id, applied in addition to `filters`. Set `greedy` to fetch each network's attrs individually (adds the connected-containers detail that `network_inspect` returns, at the cost of one extra daemon call per network) - leave it False for a fast summary list. Args: names: Network names, each an unanchored regular expression, so `web` also matches `webapp`; use `^web$` for one name ids: Network ids, matched the same way, so an id prefix finds its network filters: Additional server-side filters; see description for valid keys greedy: Fetch extended per-network details (including connected containers) managed_only: Only return networks created by this MCP server (filters on the docker-mcp-server.managed label); combines with any `filters` given Returns: list: One dict ({"Id", "Name", "Driver", "Scope", ...}) per network: summary attrs by default, full inspect attrs (adding "Containers") when greedy=True

Remove networks that have no active container endpoints. Built-in networks (bridge, host, none) are never removed. Only networks with zero connected containers are eligible. Valid filter keys: `until` (RFC3339 timestamp or duration - removes networks created before that point), `label` (key or key=value). Use `network_remove` to delete one specific network instead. Args: filters: Narrow which networks to remove; omit to remove all unused custom networks Returns: dict: {"NetworksDeleted": [...]}

Remove a single custom network by id or name. Fails if any container is still attached (disconnect with `network_disconnect` or stop the containers first). Built-in networks (`bridge`, `host`, `none`) can never be removed and return an error regardless of attachment state. For bulk cleanup of every unused custom network at once use `network_prune` instead. Returns: bool: True after removal

Get a swarm node's full inspect payload by id or name. Must run against a swarm manager. Shows role, availability, status, and manager reachability - use `node_list` to enumerate nodes first; `service_ps(filters={"node": ...})` shows what a service runs on one node. Args: id_or_name: The node id or hostname (as shown by `node_list`) Returns: dict: The node's full document (Spec{Role, Availability}, Status, ManagerStatus for managers)

List swarm nodes. Must run against a swarm manager. The fleet view of membership, role, and state; drill into one node with `node_inspect`. Args: filters: Filter by attributes (id, name, membership, role) Returns: list: One full node document per node (Spec, Status, ManagerStatus for managers)

Remove a node from the swarm. A node should normally be drained (`node_update` with Availability "drain") and have left the swarm first, so its tasks reschedule cleanly. Removing an active/reachable node requires `force=True`. Args: force: Force removal of an active/reachable node Returns: bool: True after the node is removed

Change a node's availability, role, name or labels, leaving every field not named as it was. Must run against a swarm manager. Send only what changes: {"Availability": "drain"} drains the node and keeps its role and labels. "Labels" adds or changes the labels named and keeps the rest; "RemoveLabels" removes the keys listed; a key in both is refused. Version-guarded, so a node changed by someone else since it was read fails the call rather than being overwritten. `node_inspect` shows the current `Spec`; to take a node out of the swarm use `node_remove`. Args: updates: What to change: "Availability", "Role", "Name", "Labels" as {"key": "value"}, and "RemoveLabels" as ["key", ...] Returns: bool: True after the update

Set runtime configuration options on an installed plugin. Use `plugin_inspect` first to see which keys the plugin exposes under `Settings.Env`; pass those same keys as a plain dict, e.g. `{"DEBUG": "1", "SOCKET": "/run/x.sock"}`. The plugin must be disabled before reconfiguring - call `plugin_disable` first if it is currently active, then `plugin_enable` afterwards to apply the new settings. Args: name: Plugin name, e.g. "vieux/sshfs:latest" options: Key/value settings to apply, matching the plugin's declared env keys Returns: bool: True after configuration

Disable a plugin so it stops intercepting Docker API calls; the plugin remains installed. A disabled plugin cannot be used by new containers but existing containers that already have it attached are unaffected. Use `force=True` to disable even if active containers are still using it - this may cause those containers to lose access to plugin-provided resources (e.g. a volume driver). Re-enable with `plugin_enable`. Args: force: Disable even if active containers are using the plugin (may disrupt them) Returns: bool: True after the plugin is disabled

Activate an installed plugin so Docker routes relevant API calls through it. Activates a plugin that is currently disabled - either freshly installed or previously disabled via `plugin_disable`. If the plugin exposes configuration (check via `plugin_inspect`), call `plugin_configure` while it is still disabled before enabling it. `timeout_seconds` controls how long Docker waits for the plugin process to become healthy; 0 means wait indefinitely. Args: timeout_seconds: Seconds to wait for the plugin to become healthy (0 = no timeout) Returns: bool: True after the plugin is enabled

Return the full attrs for a single installed plugin. Use this to check a plugin's `Enabled` state before calling `plugin_enable` / `plugin_disable`, or to read the config keys it exposes under `Settings.Env` before calling `plugin_configure`. For the set of all installed plugins use `plugin_list`. Args: name: Plugin name, e.g. "vieux/sshfs:latest" Returns: dict: The plugin's full document (Id, Name, Enabled, Settings, Config)