DevOps
Docker
Docker packages an application with its dependencies into a container that runs the same on a laptop, a server and the cloud.
What it is
Docker made containers mainstream after its 2013 release. A container is an isolated process with its own filesystem, network and resource limits, but it shares the kernel with the host, so it is lighter than a virtual machine.
You describe the app in a Dockerfile, build an image from it (a layered, cached snapshot), and a running instance of an image is a container. Images are stored in registries, the best known being Docker Hub. For several linked services there is Docker Compose.
Docker Engine is open source (the Moby project, Apache-2.0), while the Docker Desktop app for Mac and Windows is a commercial product with free-use limits for larger companies.
Use it when
- You want the same environment for development, tests and production.
- You deploy an app to a server, Kubernetes or a cloud container service.
- You run a database, cache or queue locally from one Compose file.
- You want to isolate dependencies of different projects.
Avoid it when
- You need strong isolation for untrusted workloads: containers share the kernel, micro-VMs or VMs are better.
- The app is a single static binary or a simple site where a container only adds complexity.
- You need rootless without a daemon: consider Podman.
Key concepts
- Image / container
- An image is an immutable template, a container is its running instance with a thin writable layer.
- Layers and cache
- Each Dockerfile instruction creates a layer; unchanged layers come from cache, so instruction order matters.
- Volume
- Storage outside the container so data survives its restart.
- Multi-stage build
- A build in several stages: heavy tools stay in the first, only the result goes to the final image.
- Docker Compose
- A description of several containers and their links in one YAML file.
Example
Cheat sheet
| Command or code | What it does |
|---|---|
docker run -d -p 8080:80 --name web nginx | Run a container in the background with a port |
docker ps -a | List containers, including stopped ones |
docker logs -f web | Follow container logs |
docker exec -it web sh | Open a shell inside a container |
docker stop web && docker rm web | Stop and remove a container |
docker build -t myapp:1.0 . | Build an image from a Dockerfile |
docker images | List local images |
docker run -v data:/var/lib/data myapp | Mount a volume for data |
docker compose up -d | Start all services from a compose file |
docker compose down | Stop and remove compose services |
docker system prune | Remove unused resources |
How to learn it
- Understand the difference between an image, a container and a virtual machine, and install Docker Desktop or Engine.
- Take the Docker basics course on ShortLesson and run your first containers with
docker run. - Write a
Dockerfilefor your app, build the image and run it with a published port. - Learn volumes and networks: keep database data outside the container and connect two containers.
- Describe an app with a database in
docker-compose.ymland bring it all up with one command. - Do a multi-stage build, add
.dockerignoreand shrink the image size. - Learn to read logs, get into a container (
exec) and diagnose crashes. - Push the image to a registry (Docker Hub, GHCR) and deploy it on a server or in CI.
Interview questions
1. How does a container differ from a virtual machine?
A VM has its own OS and a hypervisor, so it is heavier and slower. A container shares the host kernel and is isolated via namespaces and cgroups, so it starts in seconds and uses fewer resources, but isolation is weaker.
2. What is an image and how do layers work?
An image is an immutable filesystem snapshot with metadata. It consists of layers, each made by a Dockerfile instruction. Unchanged layers are cached and reused between images.
3. How do you shrink an image?
Use a small base (alpine or distroless), multi-stage builds, a .dockerignore, merge RUN commands and do not leave package manager caches.
4. How do CMD and ENTRYPOINT differ?
ENTRYPOINT sets the program that always runs, while CMD sets default arguments that docker run can override. Together they give a flexible start command.
Interview questions from the bank
- How does a Docker image differ from a container?JuniorDevOps
- How does a container differ from a virtual machine?JuniorDevOps
- What are Docker image layers and how do they affect build speed?JuniorDevOps
- How does a container keep data and how do you reach it from outside?JuniorDevOps
- Why are config and secrets not hardcoded in code and images?JuniorDevOps
- A Node app image weighs over a gigabyte, and every one-line code change reinstalls all dependencies. How do you fix the Dockerfile?MiddleDevOps
- A Dockerfile copies a token into the image and the next command deletes the file with
rm. Is the token gone, and how should you pass a secret into a build correctly?MiddleDevOps docker stopon your Node container always waits 10 seconds and then kills it. Why, and what do you do about it?MiddleDevOps
Comparisons with this technology
Related technologies
- PodmanPodman is a daemonless container engine with rootless support, a Docker-compatible CLI and the notion of a pod.
- KubernetesKubernetes is a container orchestration system that deploys, scales and heals applications across a cluster of servers.
- GitHub ActionsGitHub Actions is CI/CD built into GitHub: YAML workflows run on repository events such as push or pull request.
- nginxnginx is a fast web server and reverse proxy that also works as a load balancer and HTTP cache.
Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).