170 cards
Docker is an open-source platform that automates the deployment of applications inside lightweight, portable containers. A Docker container is a runnable instance of a Docker image: an isolated process that shares the host operating system kernel but has its own filesystem, networking, and process space. Containers are...
A Dockerfile is a script of instructions used to build an image, and the FROM instruction sets the base image on which everything else is built. FROM must be the first non-ARG instruction in the file; for example, FROM python:3.11-slim uses an official Python image as the starting point. A special value, FROM scratch,...
Every instruction in a Dockerfile produces a read-only layer, and layers are stacked to form the final image. When a container runs, a thin writable layer is added on top. Layers are cached: if an instruction and its context are unchanged, Docker reuses the cached layer instead of running the command again. This is why...
The docker command-line tool is the day-to-day interface for working with containers and images. docker run creates and starts a new container from an image, accepting many flags at once: -d for detached mode, -p for port mapping, -v for volume mounts, --name to assign a name, -e for environment variables, --network to...
Docker networking is built around several drivers, each with a different isolation and use case. The bridge driver is the default: it creates an isolated network on a single host, and containers attached to it can communicate by IP. User-defined bridges (created with docker network create mynet) are recommended over th...
Containers are ephemeral by default, but Docker provides several mechanisms for persisting data outside the container's writable layer. A Docker volume is a persistent storage object managed by Docker itself and stored in /var/lib/docker/volumes/. There are three flavors: named volumes (created explicitly with docker v...
Docker Compose is a tool for defining and running multi-container applications using a YAML file, traditionally named docker-compose.yml. The top-level structure has three sections: services (the containers themselves), networks (how they communicate), and volumes (shared storage). A service is defined under the servic...
Running containers securely starts with a handful of well-known practices. Containers should run as a non-root user, set via the USER instruction in the Dockerfile. Base images should be minimal, such as alpine, slim Debian variants, or distroless images, to reduce both attack surface and image size. Image layers shoul...