Title: Docker And Containers — LearnCoachAssist

Q: What is a container in computing?
A: A container is a lightweight, standalone, executable package that includes everything needed to run a piece of software, such as code, runtime, libraries, and dependencies, isolated from the host system.

Q: What is containerization?
A: Containerization is a virtualization method that packages an application and its dependencies into a container, enabling consistent deployment across different environments without hypervisor overhead.

Q: What is Docker?
A: Docker is an open-source platform that automates the deployment, scaling, and management of applications inside containers using containerization technology.

Q: What is the difference between a container and a virtual machine?
A: Containers share the host OS kernel and are lightweight, starting in seconds, while virtual machines include a full guest OS, making them heavier and slower to boot.
Containers virtualize at the OS level; VMs at the hardware level.

Q: What is a Docker image?
A: A Docker image is a read-only template containing the application code, libraries, dependencies, and configurations needed to create a container.

Q: What is a Docker container?
A: A Docker container is a runnable instance of a Docker image, providing an isolated environment for running applications.

Q: What is Docker Hub?
A: Docker Hub is a public registry service where users can store, share, and manage Docker images for easy access and distribution.

Q: How do you install Docker on a Linux system?
A: On Ubuntu, add Docker's official GPG key, set up the repository, update package index, and install via sudo apt install docker-ce, then start and enable the service.

Q: What is the Docker daemon?
A: The Docker daemon (dockerd) is a persistent background process that manages Docker objects like images, containers, networks, and volumes via the Docker API.

Q: What command lists all Docker images?
A: docker images or docker image ls displays a list of locally available Docker images with details like repository, tag, ID, and size.

Q: What does docker pull do?
A: docker pull <image> downloads a Docker image from a registry like Docker Hub to your local machine for use in creating containers.

Q: How do you build a Docker image from a Dockerfile?
A: Use docker build -t <name:tag> . in the directory containing the Dockerfile; the . specifies the build context as the current directory.

Q: What is a Dockerfile?
A: A Dockerfile is a text file with instructions to build a Docker image automatically, defining the base image, dependencies, environment, and runtime commands.

Q: What is the FROM instruction in a Dockerfile?
A: The FROM instruction sets the base image for the Docker build, e.g., FROM ubuntu:20.04, which must be the first non-comment instruction.

Q: What does the RUN instruction do in a Dockerfile?
A: The RUN instruction executes commands in a new layer on top of the current image during build, e.g., RUN apt-get update for installing packages.

Q: What is docker run?
A: docker run creates and starts a container from a specified image, e.g., docker run -it ubuntu bash runs an interactive Ubuntu container.

Q: What does the -d flag do with docker run?
A: The -d flag runs the container in detached mode in the background, printing the container ID, instead of foreground.

Q: What is docker ps?
A: docker ps lists running containers; add -a to show all containers including stopped ones, with details like status and ports.

Q: How do you stop a running Docker container?
A: Use docker stop <container_id> to send a SIGTERM signal gracefully, or docker kill for immediate termination with SIGKILL.

Q: What is docker exec?
A: docker exec -it <container_id> /bin/bash executes a command inside a running container, useful for interactive shell access.

Q: What are Docker volumes?
A: Docker volumes are persistent storage solutions that outlive container lifecycles, allowing data to be shared and accessed by multiple containers.

Q: What is the difference between bind mounts and volumes?
A: Bind mounts link a host directory to a container path directly, while named volumes are managed by Docker and stored in a specific host location for better portability.

Q: How do you create a Docker volume?
A: docker volume create <volume_name> creates a named volume; use docker volume ls to list them.

Q: What is Docker networking?
A: Docker networking provides isolated network stacks for containers, enabling communication via bridge, host, overlay, or custom networks.

Q: What is the default Docker network?
A: The default 'bridge' network allows containers on the same host to communicate using IP addresses or custom names.

Q: How do you create a custom Docker network?
A: docker network create <network_name> creates a bridge network by default; specify --driver overlay for multi-host.

Q: What is Docker Compose?
A: Docker Compose is a tool for defining and running multi-container Docker applications using a YAML file (docker-compose.yml) for services, networks, and volumes.

Q: What command starts services defined in docker-compose.yml?
A: docker-compose up builds/pulls images, creates networks/volumes, and starts services; add -d for detached mode.

Q: How do you view logs in Docker Compose?
A: docker-compose logs <service_name> displays logs from specified services; omit name for all services.

Q: What is a multi-stage build in Dockerfile?
A: Multi-stage builds use multiple FROM stages to optimize image size by copying only artifacts from a build stage to a runtime stage, discarding build tools.

Q: What is the WORKDIR instruction?
A: The WORKDIR instruction sets the working directory for subsequent RUN, CMD, etc., creating it if nonexistent, e.g., WORKDIR /app.

Q: What does CMD in Dockerfile do?
A: The CMD instruction provides defaults for an executing container, specifying the command and arguments; only the last one is used if multiple.

Q: What is ENTRYPOINT in Dockerfile?
A: The ENTRYPOINT configures the container's executable, making CMD arguments to it; forms include exec or shell, overriding with docker run args.

Q: What is .dockerignore?
A: The .dockerignore file specifies patterns to exclude files from the build context, like node_modules, reducing build time and image size.

Q: How do you remove a stopped container?
A: docker rm <container_id> removes one or more containers; use docker container prune to remove all stopped containers.

Q: What is Docker layer caching?
A: Docker layer caching speeds up builds by reusing unchanged layers from previous images; changes invalidate cache from that layer onward.

Q: What are Docker overlays?
A: Overlay networks enable multi-host container communication in Docker Swarm, using VXLAN encapsulation for secure overlay across hosts.

Q: What is Docker Swarm?
A: Docker Swarm is Docker's native clustering and orchestration tool for managing a swarm of Docker nodes, deploying services with replicas and load balancing.

Q: How do you initialize a Docker Swarm?
A: docker swarm init initializes the current node as a manager; it outputs a join token for worker nodes.

Q: What is a Docker service?
A: A Docker service is a declarative definition of desired container state in Swarm mode, specifying image, replicas, networks, and resources for scaling.

Q: What command deploys a service in Swarm?
A: docker service create --name <name> --replicas <num> <image> deploys a service; use docker service ls to list.

Q: What is Docker content trust?
A: Docker Content Trust (DCT) ensures image integrity and publisher authenticity using Docker Notary for signing and verifying images during push/pull.

Q: How do you enable Docker Content Trust?
A: Set environment variable export DOCKER_CONTENT_TRUST=1; it requires signed images for docker pull and run.

Q: What are Docker secrets?
A: Docker secrets are secure, encrypted objects storing sensitive data like passwords, accessible only to services via tmpfs mounts in Swarm mode.

Q: What is HEALTHCHECK in Dockerfile?
A: The HEALTHCHECK instruction defines a command to check container health, updating status in docker ps; Docker runs it periodically.

Q: What is USER instruction in Dockerfile?
A: The USER instruction sets the user/group for RUN, CMD, and ENTRYPOINT, enhancing security by avoiding root.

Q: How do you optimize Docker image size?
A: Use minimal base images like alpine, multi-stage builds, combine RUN layers with &&, clean package caches, and .dockerignore unnecessary files.

Q: What is container breakout?
A: Container breakout is a security vulnerability where a malicious container escapes isolation to access the host system, often via kernel exploits.

Q: What are best practices for Docker security?
A: Run as non-root user, use minimal images, scan for vulnerabilities (e.g., Trivy), enable content trust, limit capabilities, and avoid unnecessary privileges.

Q: What command inspects a Docker object?
A: docker inspect <object> returns low-level JSON info about containers, images, volumes, etc., for debugging.

Q: How do you troubleshoot a failing Docker container?
A: Check logs with docker logs <container>, inspect with docker inspect, exec inside, verify resources, and review events with docker events.