Docker
Beginner 12 min read Docker

What is Docker?

Docker packages an application and its dependencies into a lightweight, isolated container that runs identically anywhere Linux runs.

containersisolationimagesDocker EngineOCI
Introduction

What is this?

Docker is an open-source platform that automates the deployment of applications inside software containers. A container bundles your code, runtime, system tools, libraries and settings into one portable unit. Containers share the host operating system kernel, which makes them far lighter than virtual machines.

Motivation

Why do you need it?

  • Eliminates 'works on my machine' — the artifact you build is exactly what runs in production.
  • Dramatically smaller and faster to start than VMs because containers share the host kernel instead of running a full guest OS.
  • Reproducible builds and deploys: the same image produces the same behavior everywhere.
  • Consistent isolation for microservices — each service runs in its own sandbox with its own filesystem and network.
Think about it

Mental model

Imagine

A shipping container

Think of

A Docker container

A shipping container standardizes cargo so any crane, ship or truck can move it without knowing the contents. Docker standardizes software so any server can run it without knowing the stack.

Mechanics

How it works

  • You write a Dockerfile that describes how to assemble your image.
  • docker build executes those instructions and produces an immutable image stored on the local registry cache.
  • docker run creates a container from that image. The container gets its own filesystem layer, PID namespace, network namespace and cgroup limits.
  • The Docker daemon (dockerd) manages containers, while the client (docker CLI) talks to the daemon over a socket or API.
  • When the container's main process exits, the container stops. Data written to the writable layer is lost unless you use a volume.

How a Docker container isolates an app from the host.

Dockerfile
docker build
Image registry
docker run
Container
Reference

Key commands

docker --version

Check installed Docker Engine version.

docker info

Show system-wide information about the Docker installation.

docker run --rm -it ubuntu bash

Start an interactive Ubuntu container and drop into a shell.

docker ps -a

List all containers, including stopped ones.

docker images

List locally cached images.

Hands-on

Examples

Run your first container

Run your first container
docker run --rm -d -p 8080:80 nginx
# --rm   remove the container when it stops
# -d     run detached (in background)
# -p     8080:80  map host port 8080 to container port 80

This pulls the official nginx image, starts a container in the background, and maps host port 8080 to the container's port 80. Open http://localhost:8080 to see nginx's default page.

Real world

In production

  • Build once, run anywhere: CI produces an image that promotes unchanged through staging to production.
  • Microservices ship as independently versioned containers managed by Kubernetes or Docker Compose.
  • Ephemeral, horizontally scalable workloads: kill and recreate containers instead of patching live servers.
  • Developer environments and feature previews spin up in seconds from the same image used in prod.
Guidelines

Best practices

  • Pin image tags to specific versions or digests; never float on :latest in production.
  • Keep containers ephemeral and stateless — write durable data to volumes.
  • Run containers as non-root users with the least privileges needed.
  • Prefer running one process per container (the main process defines the lifecycle).
Watch out

Common mistakes

  • Running containers as root inside the image (privilege escalation risk).
  • Storing secrets in the image via ENV or baked into layers.
  • Using :latest in production so deploys become unreproducible.
  • Thinking containers persist data by default — the writable layer is wiped on recreation.
Root cause analysis

Common issues

Error
Cannot connect to the Docker daemon
Root cause

Client cannot reach dockerd; common on Linux when the user lacks socket permission.

Fix

Verify the daemon is running (systemctl status docker) and add your user to the docker group, then re-login.

Error
port is already allocated
Root cause

Host port is already bound by another container or process.

Fix

Find the offender with docker ps and stop it, or map to a different host port.

Error
No space left on device
Root cause

Disk image growth; dangling images and logs accumulate.

Fix

Run docker system prune -a --volumes (careful: removes unused images and volumes) and docker builder prune.

When things break

Debugging tips

  • docker ps -a to see stopped containers and their exit codes.
  • docker logs <container> to read stdout/stderr of the main process.
  • docker exec -it <container> sh to inspect a running container.
  • docker inspect <container> for low-level config including exit code and mounts.
Interviews

Interview checkpoint

Practice

Hands-on lab

Run Your First Container
20 min · beginner
In progress
Objectives
  • Pull an image and run a container
  • Inspect running containers
  • Expose a container port to the host
  • Clean up resources

Run Your First Container

20 min · beginner

0/5 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/3
1

What is the main reason containers start faster than virtual machines?

2

A container's writable layer persists by default after the container is removed.

3

Which command lists containers that are currently stopped?

Quick reference

Cheat sheet

Lifecycle
docker run IMAGECreate and start a container
docker start|stop|restart IDManage a container's state
docker rm IDDelete a stopped container
Inspection
docker ps -aList all containers
docker logs IDView container output
docker inspect IDLow-level container config
Go deeper

Official documentation

Docker Overview
docs
Docker CLI reference
docs
Open Container Initiative
spec